{ "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://antirion.ai/schema/config/v1.json", "title": "Antirion configuration document, version 1", "description": "The complete Antirion config document: every top-level key and every field. Unknown fields are rejected everywhere except declared free-form maps. `x-range` gives a duration or size field's inclusive bounds (`min`, `max`) and exclusive lower bound (`gt`); see schema/README.md. Cross-field and cross-reference rules are semantic validation and are not all expressed here.", "type": "object", "properties": { "version": { "const": 1, "description": "Schema version, required." }, "server": { "$ref": "#/$defs/Server" }, "admin": { "$ref": "#/$defs/Admin" }, "store": { "$ref": "#/$defs/Store" }, "cluster": { "$ref": "#/$defs/Cluster" }, "api": { "$ref": "#/$defs/Api" }, "providers": { "type": "object", "description": "Providers.", "propertyNames": { "$ref": "#/$defs/ProviderName" }, "additionalProperties": { "$ref": "#/$defs/Provider" } }, "deployments": { "type": "object", "description": "Deployments.", "propertyNames": { "$ref": "#/$defs/ProviderName" }, "additionalProperties": { "$ref": "#/$defs/Deployment" } }, "streaming": { "$ref": "#/$defs/Streaming" }, "models": { "type": "object", "description": "Public Models.", "propertyNames": { "$ref": "#/$defs/ModelName" }, "additionalProperties": { "$ref": "#/$defs/Model" } }, "routes": { "type": "object", "description": "Routes.", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "$ref": "#/$defs/Route" } }, "routing": { "$ref": "#/$defs/Routing" }, "resilience": { "$ref": "#/$defs/Resilience" }, "organizations": { "type": "object", "propertyNames": { "$ref": "#/$defs/TenantName" }, "additionalProperties": { "$ref": "#/$defs/Organization" } }, "teams": { "type": "object", "propertyNames": { "$ref": "#/$defs/TenantName" }, "additionalProperties": { "$ref": "#/$defs/Team" } }, "projects": { "type": "object", "propertyNames": { "$ref": "#/$defs/TenantName" }, "additionalProperties": { "$ref": "#/$defs/Project" } }, "keys": { "type": "object", "description": "Config-declared virtual keys.", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "$ref": "#/$defs/Key" } }, "users": { "type": "object", "propertyNames": { "$ref": "#/$defs/UserName" }, "additionalProperties": { "$ref": "#/$defs/User" } }, "auth": { "$ref": "#/$defs/Auth" }, "limits": { "$ref": "#/$defs/LimitsSettings" }, "budgets": { "$ref": "#/$defs/BudgetsSettings" }, "pricing": { "$ref": "#/$defs/Pricing" }, "catalog": { "$ref": "#/$defs/Catalog" }, "cache": { "$ref": "#/$defs/Cache" }, "guardrails": { "$ref": "#/$defs/Guardrails" }, "observability": { "$ref": "#/$defs/Observability" }, "mcp": { "$ref": "#/$defs/Mcp" }, "a2a": { "$ref": "#/$defs/A2a" }, "plugins": { "type": "object", "description": "Extensions.", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "$ref": "#/$defs/Plugin" } }, "security": { "$ref": "#/$defs/Security" }, "policies": { "$ref": "#/$defs/PoliciesGateway" }, "smtp": { "$ref": "#/$defs/Smtp" }, "governance": { "$ref": "#/$defs/Governance" } }, "required": [ "version" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "cluster": { "properties": { "mode": { "const": "cluster" } }, "required": [ "mode" ] } }, "required": [ "cluster" ] }, "then": { "required": [ "store" ], "properties": { "store": { "required": [ "backend" ], "properties": { "backend": { "const": "postgres" } } } } }, "description": "cluster.mode: cluster requires store.backend: postgres." }, { "if": { "properties": { "auth": { "properties": { "mode": { "const": "disabled" } }, "required": [ "mode" ] } }, "required": [ "auth" ] }, "then": { "properties": { "auth": { "properties": { "jwt": { "maxProperties": 0 } } }, "keys": { "additionalProperties": { "required": [ "kind" ], "properties": { "kind": { "const": "jwt" } } } } } }, "description": "auth.mode: disabled with any secret key or JWT provider is rejected." } ], "$defs": { "Duration": { "type": "string", "description": "Duration: digits with an optional fraction and a unit ms|s|m|h|d; no negatives; `d` = 24 h. Bounds of each field are in `x-range`.", "pattern": "^[0-9]+(\\.[0-9]+)?(ms|s|m|h|d)$" }, "DurationOrNone": { "description": "A duration, or the string \"none\" where the owning spec allows it.", "anyOf": [ { "$ref": "#/$defs/Duration" }, { "const": "none" } ] }, "Size": { "type": "string", "description": "Size with an IEC unit: B, KiB, MiB, GiB; integers only.", "pattern": "^[0-9]+(B|KiB|MiB|GiB)$" }, "Money": { "type": "string", "description": "Money: a decimal string in USD, never a number.", "pattern": "^[0-9]+(\\.[0-9]{1,12})?$" }, "Decimal": { "type": "string", "description": "A non-negative decimal string (weights, multipliers and `bytes_per_token`).", "pattern": "^[0-9]+(\\.[0-9]{1,12})?$" }, "Ratio": { "type": "number", "description": "Ratio: a JSON number in [0, 1].", "minimum": 0, "maximum": 1 }, "Weight": { "type": "integer", "description": "Weight: a non-negative integer.", "minimum": 0 }, "Rate": { "type": "string", "description": "Rate: \"/\".", "pattern": "^[1-9][0-9]*/(ms|s|m|h|d)$" }, "Secret": { "type": "string", "description": "A secret: a reference `${env:NAME}`, `${file:/abs/path}` or `${:}`, or a literal. Literals are stored encrypted and read back as \"[REDACTED]\".", "x-secret": true }, "Url": { "description": "Operator URL: http(s), no userinfo, an ASCII LDH host or a canonical IP literal, port 1–65535, never a cloud-metadata name or an always-denied IP literal.", "type": "string", "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}|\\[[0-9A-Fa-f:.]+\\]|[A-Za-z0-9][A-Za-z0-9-]*(\\.[A-Za-z0-9][A-Za-z0-9-]*)*\\.?)(:(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[1-9][0-9]{0,3}))?([/?#][^\\s]*)?$", "not": { "anyOf": [ { "$ref": "#/$defs/DeniedUrlHost" }, { "$ref": "#/$defs/NonCanonicalNumericHost" } ] } }, "HttpsUrl": { "description": "Operator URL: http(s), no userinfo, an ASCII LDH host or a canonical IP literal, port 1–65535, never a cloud-metadata name or an always-denied IP literal. https unless 's egress policy allows plain http for the host.", "type": "string", "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}|\\[[0-9A-Fa-f:.]+\\]|[A-Za-z0-9][A-Za-z0-9-]*(\\.[A-Za-z0-9][A-Za-z0-9-]*)*\\.?)(:(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[1-9][0-9]{0,3}))?([/?#][^\\s]*)?$", "not": { "anyOf": [ { "$ref": "#/$defs/DeniedUrlHost" }, { "$ref": "#/$defs/NonCanonicalNumericHost" } ] } }, "BaseUrl": { "description": "Provider base URL: an operator URL without fragment and without `.` or `..` path segments; `{region}` and `{location}` may appear in the host.", "type": "string", "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}|\\[[0-9A-Fa-f:.]+\\]|([A-Za-z0-9]|\\{(region|location)\\})([A-Za-z0-9-]|\\{(region|location)\\})*(\\.([A-Za-z0-9]|\\{(region|location)\\})([A-Za-z0-9-]|\\{(region|location)\\})*)*\\.?)(:(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[1-9][0-9]{0,3}))?([/?][^\\s#]*)?$", "not": { "anyOf": [ { "$ref": "#/$defs/DeniedUrlHost" }, { "$ref": "#/$defs/NonCanonicalNumericHost" }, { "pattern": "^[^?]*/\\.\\.?(/|\\?|$)" } ] } }, "RfcTime": { "type": "string", "description": "RFC 3339 date-time with an offset.", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\\.[0-9]+)?([Zz]|[+-][0-9]{2}:[0-9]{2})$" }, "HeaderName": { "type": "string", "description": "An HTTP header name (RFC 9110 token).", "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$" }, "LowerHeaderName": { "type": "string", "description": "A lowercase HTTP header name (`key.include_headers`).", "pattern": "^[!#$%&'*+.^_`|~0-9a-z-]+$" }, "HeaderValue": { "type": "string", "description": "A header value: no control characters other than tab; may be a secret reference.", "pattern": "^[^\\u0000-\\u0008\\u000A-\\u001F\\u007F]*$" }, "ForwardableHeaderName": { "description": "A header name that is not on 's always-deny list.", "allOf": [ { "$ref": "#/$defs/HeaderName" }, { "not": { "$ref": "#/$defs/AlwaysDenyHeader" } } ] }, "NonCredentialHeaderName": { "description": "A header name that is not a credential header.", "allOf": [ { "$ref": "#/$defs/HeaderName" }, { "not": { "pattern": "^([Aa][Uu][Tt][Hh][Oo][Rr][Ii][Zz][Aa][Tt][Ii][Oo][Nn]|[Pp][Rr][Oo][Xx][Yy]-[Aa][Uu][Tt][Hh][Oo][Rr][Ii][Zz][Aa][Tt][Ii][Oo][Nn]|[Xx]-[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Xx]-[Gg][Oo][Oo][Gg]-[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Oo][Cc][Pp]-[Aa][Pp][Ii][Mm]-[Ss][Uu][Bb][Ss][Cc][Rr][Ii][Pp][Tt][Ii][Oo][Nn]-[Kk][Ee][Yy]|[Cc][Oo][Oo][Kk][Ii][Ee]|[Xx]-[Gg][Oo][Oo][Gg]-[Uu][Ss][Ee][Rr]-[Pp][Rr][Oo][Jj][Ee][Cc][Tt])$|^[Xx]-[Aa][Mm][Zz]-" } } ] }, "Base64Key32": { "description": "A secret reference, or a literal: base64 of exactly 32 bytes.", "anyOf": [ { "type": "string", "pattern": "^\\$\\{[A-Za-z0-9_]+:[^}]+\\}$" }, { "type": "string", "pattern": "^[A-Za-z0-9+/]{43}=$" } ], "x-secret": true }, "HeaderValues": { "type": "object", "description": "Map header name → value; values may be secret references.", "propertyNames": { "$ref": "#/$defs/HeaderName" }, "additionalProperties": { "$ref": "#/$defs/HeaderValue" } }, "StringMap": { "type": "object", "description": "Map string → string.", "additionalProperties": { "type": "string" } }, "JsonPointer": { "type": "string", "description": "A JSON Pointer (RFC 6901).", "pattern": "^(/([^~/]|~[01])*)*$" }, "Glob": { "type": "string", "description": "A glob pattern (`*` wildcards).", "minLength": 1 }, "FieldPath": { "type": "string", "description": "A field path relative to a policies member, e.g. `retry.max_attempts`.", "pattern": "^[a-z0-9_]+(\\.[a-z0-9_]+)*$" }, "FieldPaths": { "type": "array", "items": { "$ref": "#/$defs/FieldPath" }, "uniqueItems": true }, "Cidr": { "type": "string", "description": "An IPv4/IPv6 address or CIDR with host bits zero.", "pattern": "^([0-9]{1,3}(\\.[0-9]{1,3}){3}(/[0-9]{1,2})?|[0-9A-Fa-f:.]*:[0-9A-Fa-f:.]*(/[0-9]{1,3})?)$" }, "HostPattern": { "type": "string", "description": "An exact host or `*.suffix`.", "pattern": "^(\\*\\.)?[A-Za-z0-9._-]+$" }, "HttpMethod": { "enum": [ "GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS" ] }, "Name": { "type": "string", "description": "Resource name, generic pattern.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }, "ProviderName": { "type": "string", "description": "Provider or deployment name (: [a-z0-9_-]{1,64}).", "pattern": "^[a-z0-9_-]{1,64}$" }, "ModelName": { "type": "string", "description": "Public Model name: 1–128 of [A-Za-z0-9._:/-], starting with a letter or digit; a wildcard Model may also contain `*`, including first.", "pattern": "^[A-Za-z0-9*][A-Za-z0-9._:/*-]{0,127}$" }, "AliasName": { "type": "string", "description": "Model alias: as a Model name, without `*`.", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$" }, "TenantName": { "type": "string", "description": "Organization, team or project name.", "pattern": "^[a-z0-9][a-z0-9_-]{0,62}$" }, "UserName": { "type": "string", "description": "User name.", "pattern": "^[a-z0-9][a-z0-9._@+-]{0,253}$" }, "GuardrailName": { "type": "string", "description": "Guardrail name.", "pattern": "^[a-z][a-z0-9_]{0,62}$" }, "PatternCheck": { "enum": [ "none", "luhn", "iban_mod97", "cpf", "cnpj" ], "description": "The checksum a match must pass to count: Luhn, the IBAN mod-97 check, or the mod-11 check digits of a Brazilian CPF or CNPJ.", "default": "none" }, "PiiCustomEntity": { "type": "object", "description": "A kind of personal data defined by a pattern. Like the built-in entities, a match never touches an ASCII letter or digit.", "properties": { "name": { "type": "string", "description": "Unique in the rule and not a built-in entity name.", "pattern": "^[a-z][a-z0-9_]{0,62}$" }, "pattern": { "type": "string", "minLength": 1, "maxLength": 1000, "description": "A regular expression, under the limits of regex rules." }, "validate": { "$ref": "#/$defs/PatternCheck" }, "label": { "type": "string", "description": "The label replacements and tokens name ([LABEL], [LABEL_1]); the name in upper case when absent.", "pattern": "^[A-Za-z][A-Za-z0-9_]{0,62}$" } }, "required": [ "name", "pattern" ], "additionalProperties": false }, "McpName": { "type": "string", "description": "MCP server or A2A agent name.", "pattern": "^[a-z0-9]([a-z0-9-]{0,30}[a-z0-9])?$" }, "PriorityClass": { "type": "string", "description": "A priority class name.", "pattern": "^[a-z0-9_]{1,64}$" }, "LimitName": { "type": "string", "description": "Limit or budget declaration name. `locked` and `request_overridable` are reserved.", "pattern": "^[a-z0-9_]{1,64}$", "not": { "enum": [ "locked", "request_overridable" ] } }, "NotReservedName": { "description": "`locked` and `request_overridable` are reserved inside every `policies` member: no named entry may use them (detail code `reserved_name`).", "not": { "enum": [ "locked", "request_overridable" ] } }, "NodeId": { "type": "string", "description": "Route-tree node id.", "pattern": "^[a-z0-9][a-z0-9_-]{0,63}$" }, "Tag": { "description": "A tag (grammar); the `antirion.` prefix is reserved.", "type": "string", "pattern": "^[A-Za-z0-9:_.-]{1,64}$", "not": { "pattern": "^[Aa][Nn][Tt][Ii][Rr][Ii][Oo][Nn]\\." } }, "TagPattern": { "type": "string", "description": "A tag pattern with at most one `*`.", "pattern": "^[A-Za-z0-9:_.-]*\\*?[A-Za-z0-9:_.-]*$", "minLength": 1 }, "NamePattern": { "type": "string", "description": "A name pattern: an exact name, one `*` at the start or the end, or `*` alone.", "pattern": "^(\\*|\\*?[^*]+|[^*]+\\*)$" }, "ModelPattern": { "type": "string", "description": "Model pattern: exact name, one `*` at the start or the end, `*`, `provider/*`, `provider/name`, or `group:`.", "pattern": "^(group:[A-Za-z0-9._-]+|\\*|\\*?[^*]+|[^*]+\\*)$" }, "EndpointId": { "enum": [ "chat_completions", "responses", "completions", "embeddings", "images", "audio", "moderations", "files", "batches", "realtime", "messages", "count_tokens", "models", "gemini", "bedrock", "rerank" ], "description": "Endpoint id." }, "Dialect": { "enum": [ "openai_chat", "openai_responses", "openai_completions", "openai_embeddings", "openai_images", "openai_audio", "openai_moderations", "openai_files", "openai_batches", "openai_realtime", "anthropic_messages", "gemini", "bedrock_converse", "bedrock_invoke", "rerank" ], "description": "Dialect id." }, "ProviderType": { "enum": [ "openai", "azure_openai", "anthropic", "bedrock", "vertex", "gemini", "openai_compatible", "anthropic_compatible", "mistral", "cohere", "groq", "together", "fireworks", "deepseek", "xai", "cerebras", "deepinfra", "perplexity", "huggingface", "replicate", "databricks", "sagemaker", "watsonx", "ollama_native", "triton" ], "description": "Provider type." }, "EndpointFamily": { "enum": [ "chat", "responses", "messages", "embeddings", "images", "audio", "moderations", "rerank", "files", "batches", "realtime", "models", "gemini", "bedrock", "mcp", "a2a", "*" ], "description": "Endpoint family or `*`." }, "ClientTls": { "type": "object", "description": "Client TLS block, used at providers..tls and observability.traces.exporter.tls.", "properties": { "verify": { "type": "boolean", "description": "false only for operator destinations; logged and reported.", "default": true }, "ca_file": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null }, "server_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null }, "min_version": { "enum": [ "1.2", "1.3" ], "default": "1.2" }, "client_cert_file": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null }, "client_key_file": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null } }, "additionalProperties": false, "dependentRequired": { "client_cert_file": [ "client_key_file" ], "client_key_file": [ "client_cert_file" ] } }, "PolicyTranslation": { "type": "object", "description": "`policies.translation` member.", "properties": { "on_lossy": { "enum": [ "warn", "reject" ], "default": "warn" }, "forward_unknown_fields": { "type": "boolean", "default": false }, "reasoning_budgets": { "type": "object", "description": "Effort → thinking budget; each ≥ 1024, non-decreasing.", "properties": { "minimal": { "type": "integer", "minimum": 1024 }, "low": { "type": "integer", "minimum": 1024 }, "medium": { "type": "integer", "minimum": 1024 }, "high": { "type": "integer", "minimum": 1024 }, "xhigh": { "type": "integer", "minimum": 1024 }, "max": { "type": "integer", "minimum": 1024 } }, "additionalProperties": false, "default": { "minimal": 1024, "low": 2048, "medium": 8192, "high": 16384, "xhigh": 32768, "max": 32768 } }, "n_fan_out": { "type": "object", "description": "A non-streaming Chat Completions request with n > 1 to a deployment without native n is served by n parallel upstream calls.", "properties": { "enabled": { "type": "boolean", "default": false }, "max": { "type": "integer", "minimum": 2, "maximum": 128, "default": 8, "description": "The largest n emulated; a larger n keeps the capability rule." } }, "additionalProperties": false }, "completions_to_chat": { "type": "boolean", "default": false, "description": "A /v1/completions request whose Model has no deployment serving Completions is served as a Chat Completions request." }, "locked": { "$ref": "#/$defs/FieldPaths" }, "request_overridable": { "$ref": "#/$defs/FieldPaths" } }, "additionalProperties": false }, "Api": { "type": "object", "description": "Top-level `api`.", "properties": { "endpoints": { "type": "object", "description": "Map endpoint id → settings. `default_model` does not exist.", "properties": { "chat_completions": { "$ref": "#/$defs/EndpointToggle" }, "responses": { "$ref": "#/$defs/EndpointToggle" }, "completions": { "$ref": "#/$defs/EndpointToggle" }, "embeddings": { "$ref": "#/$defs/EndpointToggle" }, "images": { "$ref": "#/$defs/EndpointToggle" }, "audio": { "$ref": "#/$defs/EndpointToggle" }, "moderations": { "$ref": "#/$defs/EndpointToggle" }, "files": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "default_provider": { "anyOf": [ { "$ref": "#/$defs/ProviderName" }, { "type": "null" } ] } }, "additionalProperties": false }, "batches": { "$ref": "#/$defs/EndpointToggle" }, "realtime": { "$ref": "#/$defs/EndpointToggle" }, "messages": { "$ref": "#/$defs/EndpointToggle" }, "count_tokens": { "$ref": "#/$defs/EndpointToggle" }, "models": { "$ref": "#/$defs/EndpointToggle" }, "gemini": { "$ref": "#/$defs/EndpointToggle" }, "bedrock": { "$ref": "#/$defs/EndpointToggle" }, "rerank": { "$ref": "#/$defs/EndpointToggle" }, "responses_websocket": { "$ref": "#/$defs/EndpointToggle", "description": "Responses events over a WebSocket on GET /v1/responses; default true, and only while `responses` is enabled." } }, "additionalProperties": false }, "provider_mounts": { "type": "boolean", "default": true }, "azure_paths": { "type": "boolean", "default": false }, "response_model": { "enum": [ "requested", "upstream" ], "default": "requested" }, "responses": { "type": "object", "properties": { "state": { "enum": [ "gateway", "native_only" ], "default": "gateway" }, "ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "1m", "max": "365d" }, "default": "30d" }, "max_stored_bytes": { "$ref": "#/$defs/Size", "x-range": { "min": "64KiB", "max": "1GiB" }, "default": "32MiB" }, "max_chain_depth": { "type": "integer", "minimum": 1, "default": 1000 } }, "additionalProperties": false }, "images": { "type": "object", "properties": { "max_n": { "type": "integer", "minimum": 1, "maximum": 128, "default": 10 } }, "additionalProperties": false }, "media_fetch": { "type": "object", "description": "; per-fetch limits are security.media_fetch.", "properties": { "enabled": { "type": "boolean", "default": true }, "max_total_bytes": { "$ref": "#/$defs/Size", "description": "≥ security.media_fetch.max_bytes, ≤ 4 × the body limit.", "default": "50MiB" }, "max_objects": { "type": "integer", "minimum": 1, "maximum": 256, "default": 20 } }, "additionalProperties": false }, "reasoning_replay": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": true }, "ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "1m" }, "default": "24h" }, "max_entry_bytes": { "$ref": "#/$defs/Size", "x-range": { "min": "1KiB" }, "default": "256KiB" } }, "additionalProperties": false }, "passthrough": { "type": "object", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "object", "properties": { "path_prefix": { "type": "string", "pattern": "^/" }, "provider": { "$ref": "#/$defs/ProviderName" }, "methods": { "type": "array", "items": { "$ref": "#/$defs/HttpMethod" }, "minItems": 1, "uniqueItems": true, "default": [ "GET", "POST", "DELETE" ] } }, "required": [ "path_prefix", "provider" ], "additionalProperties": false } } }, "additionalProperties": false }, "Params": { "type": "object", "description": "Provider/deployment params.", "properties": { "remove": { "type": "array", "items": { "allOf": [ { "$ref": "#/$defs/JsonPointer" }, { "pattern": "^/" }, { "not": { "pattern": "^/(model|stream)(/|$)" } }, { "not": { "pattern": "/-(/|$)" } } ], "description": "Pointer into the upstream body; `/model`, `/stream` and the `-` token are rejected." } }, "defaults": { "type": "object", "propertyNames": { "allOf": [ { "$ref": "#/$defs/JsonPointer" }, { "pattern": "^/" }, { "not": { "pattern": "^/(model|stream)(/|$)" } }, { "not": { "pattern": "/-(/|$)" } } ], "description": "Pointer into the upstream body; `/model`, `/stream` and the `-` token are rejected." } }, "overrides": { "type": "object", "propertyNames": { "allOf": [ { "$ref": "#/$defs/JsonPointer" }, { "pattern": "^/" }, { "not": { "pattern": "^/(model|stream)(/|$)" } }, { "not": { "pattern": "/-(/|$)" } } ], "description": "Pointer into the upstream body; `/model`, `/stream` and the `-` token are rejected." } } }, "additionalProperties": false }, "Capabilities": { "type": "object", "description": "Capability flags; any subset.", "properties": { "dialects": { "type": "array", "items": { "$ref": "#/$defs/Dialect" }, "uniqueItems": true }, "operations": { "type": "array", "items": { "enum": [ "generate", "embed", "image_generate", "transcribe", "speech", "moderate", "rerank", "count_tokens", "files", "batches", "realtime" ] }, "uniqueItems": true }, "streaming": { "type": "boolean" }, "stream_usage": { "type": "boolean" }, "tools": { "type": "boolean" }, "tool_choice_forced": { "type": "boolean" }, "parallel_tool_calls": { "type": "boolean" }, "json_mode": { "type": "boolean" }, "json_schema": { "type": "boolean" }, "vision": { "type": "boolean" }, "audio_input": { "type": "boolean" }, "pdf_input": { "type": "boolean" }, "reasoning": { "type": "boolean" }, "n_multiple": { "type": "boolean" }, "logprobs": { "type": "boolean" }, "prompt_cache_markers": { "type": "boolean" }, "accepts_max_tokens": { "type": "boolean" }, "developer_role": { "type": "boolean" }, "accepts_cache_control": { "type": "boolean" }, "exclusive_temperature_top_p": { "type": "boolean" }, "native_structured_output": { "type": "boolean" }, "reasoning_can_disable": { "type": "boolean" }, "reasoning_budget_ok": { "type": "boolean" }, "thought_signatures": { "type": "boolean" }, "image_url_input": { "type": "boolean" }, "document_url_input": { "type": "boolean" }, "count_tokens_native": { "type": "boolean" }, "responses_native": { "type": "boolean" }, "context_window": { "type": "integer", "minimum": 1 }, "max_input_tokens": { "type": "integer", "minimum": 1 }, "max_output_tokens": { "type": "integer", "minimum": 1 }, "tokenizer": { "type": "string", "minLength": 1 }, "max_n": { "type": "integer", "minimum": 1 }, "max_cache_breakpoints": { "type": "integer", "minimum": 0 }, "temperature_range": { "type": "array", "items": { "type": "number" }, "minItems": 2, "maxItems": 2 }, "reasoning_control": { "enum": [ "effort", "adaptive", "budget", "level", "none" ] }, "reasoning_efforts": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "reasoning_min_budget": { "type": "integer", "minimum": 0 }, "reasoning_max_budget": { "type": "integer", "minimum": 0 }, "reasoning_family": { "enum": [ "anthropic", "openai", "gemini", "none" ] }, "tool_name_pattern": { "type": "string" }, "tool_name_max_len": { "type": "integer", "minimum": 1 }, "image_formats": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "document_formats": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "audio_formats": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "assistant_prefill": { "type": "boolean", "description": "A final assistant turn is continued." }, "sampling_params": { "type": "boolean", "description": "temperature/top_p/top_k accepted." }, "max_stop_sequences": { "type": "integer", "minimum": 1, "description": "Largest number of stop sequences accepted; 4 when unknown." } }, "additionalProperties": false }, "ProviderAuth": { "type": "object", "description": "Upstream authentication.", "properties": { "method": { "enum": [ "api_key", "aws_sigv4", "gcp", "azure_ad", "none" ], "description": "Default: the type's first method." }, "api_key": { "$ref": "#/$defs/Secret" }, "api_keys": { "type": "array", "description": "Selection among keys:", "items": { "type": "object", "properties": { "name": { "$ref": "#/$defs/Name" }, "key": { "$ref": "#/$defs/Secret" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 } }, "required": [ "name", "key" ], "additionalProperties": false }, "minItems": 1, "maxItems": 256 }, "header": { "$ref": "#/$defs/HeaderName", "description": "openai_compatible only.", "default": "Authorization" }, "prefix": { "type": "string", "description": "openai_compatible only; may be empty.", "default": "Bearer " }, "access_key_id": { "$ref": "#/$defs/Secret" }, "secret_access_key": { "$ref": "#/$defs/Secret" }, "session_token": { "$ref": "#/$defs/Secret" }, "assume_role": { "type": "object", "properties": { "role_arn": { "type": "string", "pattern": "^arn:" }, "external_id": { "type": "string" }, "session_name": { "type": "string", "minLength": 1, "default": "antirion" }, "duration": { "$ref": "#/$defs/Duration", "x-range": { "min": "15m", "max": "12h" }, "default": "1h" }, "sts_endpoint": { "type": [ "string", "null" ], "format": "uri", "default": null, "description": "Optional STS endpoint URL; default: the regional AWS STS endpoint." } }, "required": [ "role_arn" ], "additionalProperties": false }, "service_account_json": { "$ref": "#/$defs/Secret", "description": "Secret reference or literal JSON; absent = ADC." }, "scopes": { "type": "array", "items": { "type": "string" }, "minItems": 1, "default": [ "https://www.googleapis.com/auth/cloud-platform" ] }, "tenant_id": { "type": "string" }, "client_id": { "type": "string" }, "client_secret": { "$ref": "#/$defs/Secret" }, "token_file": { "type": "string" }, "managed_identity": { "type": "boolean", "default": false }, "authority_host": { "$ref": "#/$defs/Url", "default": "https://login.microsoftonline.com" }, "scope": { "type": "string", "default": "https://cognitiveservices.azure.com/.default" } }, "additionalProperties": false, "allOf": [ { "if": { "properties": { "method": { "const": "api_key" } }, "required": [ "method" ] }, "then": { "$ref": "#/$defs/ProviderAuthFields_api_key" } }, { "if": { "properties": { "method": { "const": "aws_sigv4" } }, "required": [ "method" ] }, "then": { "$ref": "#/$defs/ProviderAuthFields_aws_sigv4" } }, { "if": { "properties": { "method": { "const": "gcp" } }, "required": [ "method" ] }, "then": { "$ref": "#/$defs/ProviderAuthFields_gcp" } }, { "if": { "properties": { "method": { "const": "azure_ad" } }, "required": [ "method" ] }, "then": { "$ref": "#/$defs/ProviderAuthFields_azure_ad" } }, { "if": { "properties": { "method": { "const": "none" } }, "required": [ "method" ] }, "then": { "$ref": "#/$defs/ProviderAuthFields_none" } }, { "dependentRequired": { "access_key_id": [ "secret_access_key" ], "secret_access_key": [ "access_key_id" ] } } ] }, "Provider": { "type": "object", "description": "A provider. Type-specific blocks must match `type`.", "properties": { "type": { "$ref": "#/$defs/ProviderType" }, "base_url": { "$ref": "#/$defs/BaseUrl", "description": "Default per type." }, "enabled": { "type": "boolean", "default": true }, "auth": { "$ref": "#/$defs/ProviderAuth" }, "byok": { "enum": [ "disabled", "allowed", "required" ], "default": "disabled" }, "headers": { "type": "object", "description": "Extra upstream headers; credential, framing, hop-by-hop and always-deny names are rejected.", "propertyNames": { "$ref": "#/$defs/ForwardableHeaderName" }, "additionalProperties": { "$ref": "#/$defs/HeaderValue" } }, "params": { "$ref": "#/$defs/Params" }, "capabilities": { "$ref": "#/$defs/Capabilities" }, "operations": { "type": "object", "description": "Per-operation path override; starts with `/` and not `//`.", "propertyNames": { "enum": [ "generate", "embed", "image_generate", "transcribe", "speech", "moderate", "rerank", "count_tokens", "files", "batches", "realtime" ] }, "additionalProperties": { "type": "object", "properties": { "path": { "type": "string", "pattern": "^/([^/].*)?$" } }, "required": [ "path" ], "additionalProperties": false } }, "http": { "type": "object", "properties": { "version": { "enum": [ "auto", "http1", "h2", "h2c" ], "default": "auto" } }, "additionalProperties": false }, "tls": { "$ref": "#/$defs/ClientTls", "description": "per-provider TLS." }, "openai": { "type": "object", "properties": { "organization": { "type": "string" }, "project": { "type": "string" } }, "additionalProperties": false }, "azure": { "type": "object", "description": "api_version required iff api_style = deployments, and rejected otherwise.", "properties": { "api_style": { "enum": [ "v1", "deployments" ], "default": "v1" }, "api_version": { "type": "string", "minLength": 1 } }, "additionalProperties": false, "allOf": [ { "if": { "properties": { "api_style": { "const": "deployments" } }, "required": [ "api_style" ] }, "then": { "required": [ "api_version" ] }, "else": { "properties": { "api_version": false } } } ] }, "anthropic": { "type": "object", "properties": { "version": { "type": "string", "minLength": 1, "default": "2023-06-01" }, "beta": { "type": "array", "items": { "type": "string" }, "default": [] } }, "additionalProperties": false, "description": "Anthropic settings: on `anthropic`, and on `bedrock` / `vertex` for their Anthropic models. `version` is not sent on Bedrock and Vertex, whose body carries `anthropic_version`." }, "aws": { "type": "object", "properties": { "region": { "type": "string", "minLength": 1 } }, "required": [ "region" ], "additionalProperties": false }, "gcp": { "type": "object", "properties": { "project": { "type": "string", "minLength": 1 }, "location": { "type": "string", "minLength": 1, "default": "global" }, "quota_project": { "type": "string" } }, "additionalProperties": false }, "gemini": { "type": "object", "properties": { "api_version": { "enum": [ "v1beta", "v1" ], "default": "v1beta" } }, "additionalProperties": false }, "account_tier": { "type": "string", "minLength": 1, "maxLength": 64, "description": "Display only." }, "credential_rotation_max_age": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } } }, "required": [ "type" ], "additionalProperties": false, "allOf": [ { "if": { "not": { "properties": { "type": { "enum": [ "openai" ] } }, "required": [ "type" ] } }, "then": { "properties": { "openai": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "azure_openai" ] } }, "required": [ "type" ] } }, "then": { "properties": { "azure": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "anthropic", "bedrock", "vertex" ] } }, "required": [ "type" ] } }, "then": { "properties": { "anthropic": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "bedrock" ] } }, "required": [ "type" ] } }, "then": { "properties": { "aws": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "vertex" ] } }, "required": [ "type" ] } }, "then": { "properties": { "gcp": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "gemini" ] } }, "required": [ "type" ] } }, "then": { "properties": { "gemini": false } } }, { "if": { "properties": { "type": { "enum": [ "azure_openai", "openai_compatible", "anthropic_compatible" ] } }, "required": [ "type" ] }, "then": { "required": [ "base_url" ] } }, { "if": { "properties": { "type": { "const": "bedrock" } }, "required": [ "type" ] }, "then": { "required": [ "aws" ] } }, { "if": { "properties": { "type": { "const": "azure_openai" } }, "required": [ "type" ] }, "then": { "properties": { "base_url": { "not": { "pattern": "^[^?#]*/openai(/v1)?/*(\\?.*)?$" }, "description": "A base path ending in /openai or /openai/v1 is rejected (step 6)." } } } }, { "if": { "properties": { "type": { "const": "vertex" }, "auth": { "not": { "properties": { "method": { "const": "api_key" } }, "required": [ "method" ] } } }, "required": [ "type" ] }, "then": { "required": [ "gcp" ], "properties": { "gcp": { "required": [ "project" ] } } }, "description": "vertex needs gcp.project, except with auth.method api_key (express mode)." }, { "if": { "properties": { "type": { "const": "openai" } }, "required": [ "type" ] }, "then": { "properties": { "auth": { "properties": { "method": { "enum": [ "api_key" ] } } } }, "required": [ "auth" ], "allOf": [ { "properties": { "auth": { "if": { "not": { "required": [ "method" ] } }, "then": { "$ref": "#/$defs/ProviderAuthFields_api_key" } } } } ] } }, { "if": { "properties": { "type": { "const": "azure_openai" } }, "required": [ "type" ] }, "then": { "properties": { "auth": { "properties": { "method": { "enum": [ "api_key", "azure_ad" ] } } } }, "required": [ "auth" ], "allOf": [ { "properties": { "auth": { "if": { "not": { "required": [ "method" ] } }, "then": { "$ref": "#/$defs/ProviderAuthFields_api_key" } } } } ] } }, { "if": { "properties": { "type": { "const": "anthropic" } }, "required": [ "type" ] }, "then": { "properties": { "auth": { "properties": { "method": { "enum": [ "api_key" ] } } } }, "required": [ "auth" ], "allOf": [ { "properties": { "auth": { "if": { "not": { "required": [ "method" ] } }, "then": { "$ref": "#/$defs/ProviderAuthFields_api_key" } } } } ] } }, { "if": { "properties": { "type": { "const": "bedrock" } }, "required": [ "type" ] }, "then": { "properties": { "auth": { "properties": { "method": { "enum": [ "aws_sigv4", "api_key" ] } } } }, "allOf": [ { "properties": { "auth": { "if": { "not": { "required": [ "method" ] } }, "then": { "$ref": "#/$defs/ProviderAuthFields_aws_sigv4" } } } } ] } }, { "if": { "properties": { "type": { "const": "vertex" } }, "required": [ "type" ] }, "then": { "properties": { "auth": { "properties": { "method": { "enum": [ "gcp", "api_key" ] } } } }, "allOf": [ { "properties": { "auth": { "if": { "not": { "required": [ "method" ] } }, "then": { "$ref": "#/$defs/ProviderAuthFields_gcp" } } } } ] } }, { "if": { "properties": { "type": { "const": "gemini" } }, "required": [ "type" ] }, "then": { "properties": { "auth": { "properties": { "method": { "enum": [ "api_key" ] } } } }, "required": [ "auth" ], "allOf": [ { "properties": { "auth": { "if": { "not": { "required": [ "method" ] } }, "then": { "$ref": "#/$defs/ProviderAuthFields_api_key" } } } } ] } }, { "if": { "properties": { "type": { "const": "openai_compatible" } }, "required": [ "type" ] }, "then": { "properties": { "auth": { "properties": { "method": { "enum": [ "api_key", "none" ] } } } }, "required": [ "auth" ], "allOf": [ { "properties": { "auth": { "if": { "not": { "required": [ "method" ] } }, "then": { "$ref": "#/$defs/ProviderAuthFields_api_key" } } } } ] } }, { "if": { "properties": { "type": { "const": "anthropic_compatible" } }, "required": [ "type" ] }, "then": { "properties": { "auth": { "properties": { "method": { "enum": [ "api_key" ] } } } }, "required": [ "auth" ], "allOf": [ { "properties": { "auth": { "if": { "not": { "required": [ "method" ] } }, "then": { "$ref": "#/$defs/ProviderAuthFields_api_key" } } } } ] } }, { "if": { "not": { "properties": { "type": { "enum": [ "openai_compatible" ] } }, "required": [ "type" ] } }, "then": { "properties": { "auth": { "properties": { "header": false, "prefix": false } } } } } ] }, "Weights": { "type": "object", "description": "Pricing class → weight, a decimal ≥ 0; omitted classes = 1.", "propertyNames": { "enum": [ "input_text", "input_audio_uncached", "input_image_uncached", "input_video_uncached", "input_cache_read", "input_cache_write_5m", "input_cache_write_1h", "output_text", "output_reasoning", "output_audio", "output_image" ] }, "additionalProperties": { "$ref": "#/$defs/Decimal" } }, "Match": { "type": "object", "description": "All present fields must match; each list is OR.", "properties": { "models": { "type": "array", "items": { "$ref": "#/$defs/Glob" } }, "endpoints": { "type": "array", "items": { "$ref": "#/$defs/EndpointId" } }, "tags": { "type": "array", "items": { "$ref": "#/$defs/Glob" } }, "mcp_servers": { "type": "array", "items": { "$ref": "#/$defs/Glob" } }, "mcp_tools": { "type": "array", "items": { "$ref": "#/$defs/Glob" } }, "a2a_agents": { "type": "array", "items": { "$ref": "#/$defs/Glob" } } }, "additionalProperties": false }, "PartitionBy": { "type": "array", "description": "Partition attributes (mcp_*/a2a_agent).", "items": { "type": "string", "pattern": "^(key|project|team|organization|user|end_user|model|ip|endpoint|mcp_server|mcp_tool|a2a_agent|tag:[A-Za-z0-9:_.-]{1,64})$" }, "uniqueItems": true }, "Limit": { "type": "object", "description": "A limit declaration.", "properties": { "unit": { "enum": [ "requests", "tokens", "concurrency" ] }, "limit": { "type": "integer", "description": "0 refuses every request.", "minimum": 0 }, "per": { "$ref": "#/$defs/Duration", "x-range": { "min": "1s" }, "description": "Required unless unit=concurrency, forbidden for it." }, "burst": { "type": "integer", "description": "gcra only; default = limit.", "minimum": 1 }, "algorithm": { "enum": [ "gcra", "sliding_window" ] }, "precision": { "type": "integer", "description": "sliding_window only.", "minimum": 1, "maximum": 3600, "default": 60 }, "tokens": { "enum": [ "total", "input", "output", "weighted" ], "default": "total" }, "weights": { "$ref": "#/$defs/Weights" }, "count": { "enum": [ "admitted", "successful" ], "description": "unit=requests only.", "default": "admitted" }, "partition_by": { "$ref": "#/$defs/PartitionBy", "default": [] }, "on_missing": { "enum": [ "shared", "skip", "reject" ], "default": "shared" }, "overrides": { "type": "object", "description": "Per partition value; requires exactly one partition attribute.", "additionalProperties": { "type": "integer", "minimum": 0 } }, "match": { "$ref": "#/$defs/Match" }, "exclude": { "$ref": "#/$defs/Match" }, "enforce": { "type": "boolean", "description": "false = shadow.", "default": true }, "on_store_unavailable": { "enum": [ "local_share", "fail_closed", "fail_open" ] }, "priority_shares": { "type": "object", "description": "Priority class (a key's `priority_class`) → its share of the limit, a ratio; the shares add up to at most 1, and classes without a share count together in the remainder.", "propertyNames": { "$ref": "#/$defs/PriorityClass" }, "additionalProperties": { "$ref": "#/$defs/Ratio" }, "minProperties": 1 }, "priority_mode": { "enum": [ "strict", "borrow" ], "description": "Only with `priority_shares`: `strict` keeps each class within its share; `borrow` lets a class use the rest of the limit except what the other classes have not used of their shares.", "default": "strict" } }, "required": [ "unit", "limit" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "unit": { "const": "concurrency" } } }, "then": { "properties": { "per": false } }, "else": { "required": [ "per" ] } }, { "if": { "not": { "properties": { "unit": { "enum": [ "tokens" ] } }, "required": [ "unit" ] } }, "then": { "properties": { "tokens": false } } }, { "if": { "not": { "properties": { "unit": { "enum": [ "tokens" ] } }, "required": [ "unit" ] } }, "then": { "properties": { "weights": false } } }, { "if": { "not": { "properties": { "unit": { "enum": [ "requests" ] } }, "required": [ "unit" ] } }, "then": { "properties": { "count": false } } }, { "dependentSchemas": { "overrides": { "required": [ "partition_by" ], "properties": { "partition_by": { "minItems": 1, "maxItems": 1 } } } } } ] }, "Budget": { "type": "object", "description": "A budget declaration.", "properties": { "unit": { "enum": [ "usd", "tokens" ] }, "amount": { "description": "usd: decimal string ≥ 0 with ≤ 9 decimals; tokens: integer ≥ 0.", "anyOf": [ { "type": "string", "pattern": "^[0-9]+(\\.[0-9]{1,9})?$" }, { "type": "integer", "minimum": 0 } ] }, "period": { "anyOf": [ { "enum": [ "lifetime", "daily", "weekly", "monthly", "quarterly", "yearly" ] }, { "$ref": "#/$defs/Duration", "x-range": { "min": "1s" } } ] }, "timezone": { "type": "string", "description": "IANA zone; calendar periods only.", "minLength": 1, "default": "UTC" }, "week_start": { "enum": [ "monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday" ], "default": "monday" }, "algorithm": { "enum": [ "sliding_window" ], "description": "A rolling budget over a duration `period`. Absent: the period's own windows (calendar, lifetime or fixed duration)." }, "precision": { "type": "integer", "minimum": 1, "description": "Sliding_window only: sub-windows per period; each sub-window is at least 1 s and a whole number of microseconds. Default: hourly sub-windows (period / 1h, at least 1), which depends on `period`, so no `default` keyword." }, "mode": { "enum": [ "hard", "soft", "approval" ], "default": "hard" }, "alert_at": { "type": "array", "description": "Ratios: numbers in [0, 1], strictly increasing.", "items": { "$ref": "#/$defs/Ratio" }, "uniqueItems": true }, "tokens": { "enum": [ "total", "input", "output", "weighted" ], "default": "total" }, "weights": { "$ref": "#/$defs/Weights" }, "partition_by": { "$ref": "#/$defs/PartitionBy", "default": [] }, "on_missing": { "enum": [ "shared", "skip", "reject" ], "default": "shared" }, "overrides": { "type": "object", "additionalProperties": { "anyOf": [ { "type": "string", "pattern": "^[0-9]+(\\.[0-9]{1,9})?$" }, { "type": "integer", "minimum": 0 } ] } }, "match": { "$ref": "#/$defs/Match", "default": {} }, "exclude": { "$ref": "#/$defs/Match", "default": {} }, "on_store_unavailable": { "enum": [ "fail_closed", "local_share" ] }, "allow_above_parent": { "type": "boolean", "default": false }, "cache_hits_bypass_budgets": { "type": "boolean", "description": "Defer this budget's refusal until after cache_lookup, so a cache hit is served without consulting it.", "default": false }, "owner": { "$ref": "#/$defs/UserName" }, "downgrade": { "type": "object", "properties": { "at": { "$ref": "#/$defs/Ratio" }, "to_model": { "$ref": "#/$defs/ModelName" }, "to_tier": { "$ref": "#/$defs/Tier" } }, "required": [ "at" ], "additionalProperties": false, "oneOf": [ { "required": [ "to_model" ] }, { "required": [ "to_tier" ] } ] } }, "required": [ "unit", "amount" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "unit": { "const": "usd" } }, "required": [ "unit" ] }, "then": { "properties": { "amount": { "type": "string" }, "overrides": { "additionalProperties": { "type": "string" } } } } }, { "if": { "properties": { "unit": { "const": "tokens" } }, "required": [ "unit" ] }, "then": { "properties": { "amount": { "type": "integer" }, "overrides": { "additionalProperties": { "type": "integer" } } } } }, { "if": { "not": { "properties": { "unit": { "enum": [ "tokens" ] } }, "required": [ "unit" ] } }, "then": { "properties": { "tokens": false } } }, { "if": { "not": { "properties": { "unit": { "enum": [ "tokens" ] } }, "required": [ "unit" ] } }, "then": { "properties": { "weights": false } } }, { "if": { "properties": { "period": { "enum": [ "daily", "weekly", "monthly", "quarterly", "yearly" ] } }, "required": [ "period" ] }, "else": { "properties": { "timezone": false } } }, { "if": { "not": { "properties": { "period": { "enum": [ "weekly" ] } }, "required": [ "period" ] } }, "then": { "properties": { "week_start": false } } }, { "dependentSchemas": { "overrides": { "required": [ "partition_by" ], "properties": { "partition_by": { "minItems": 1, "maxItems": 1 } } } } }, { "if": { "properties": { "period": { "enum": [ "lifetime", "daily", "weekly", "monthly", "quarterly", "yearly" ] } }, "required": [ "period" ] }, "then": { "properties": { "algorithm": false } } }, { "if": { "not": { "properties": { "algorithm": { "const": "sliding_window" } }, "required": [ "algorithm" ] } }, "then": { "properties": { "precision": false } } } ] }, "Price": { "type": "object", "description": "A price: token rates in USD per 1M tokens, unit prices in USD, optional tiers.", "properties": { "input": { "$ref": "#/$defs/Money" }, "output": { "$ref": "#/$defs/Money" }, "cache_read": { "$ref": "#/$defs/Money" }, "cache_write_5m": { "$ref": "#/$defs/Money" }, "cache_write_1h": { "$ref": "#/$defs/Money" }, "reasoning": { "$ref": "#/$defs/Money" }, "input_audio": { "$ref": "#/$defs/Money" }, "input_image": { "$ref": "#/$defs/Money" }, "input_video": { "$ref": "#/$defs/Money" }, "output_audio": { "$ref": "#/$defs/Money" }, "output_image": { "$ref": "#/$defs/Money" }, "per_request": { "$ref": "#/$defs/Money" }, "per_audio_second_in": { "$ref": "#/$defs/Money" }, "per_1k_characters_in": { "$ref": "#/$defs/Money" }, "per_page": { "$ref": "#/$defs/Money" }, "per_web_search": { "$ref": "#/$defs/Money" }, "per_image": { "type": "object", "description": "\"/\" → USD.", "propertyNames": { "type": "string", "pattern": "^[^/]+/[^/]+$" }, "additionalProperties": { "$ref": "#/$defs/Money" } }, "tiers": { "type": "array", "items": { "type": "object", "properties": { "above_input_tokens": { "type": "integer", "minimum": 0 }, "input": { "$ref": "#/$defs/Money" }, "output": { "$ref": "#/$defs/Money" }, "cache_read": { "$ref": "#/$defs/Money" }, "cache_write_5m": { "$ref": "#/$defs/Money" }, "cache_write_1h": { "$ref": "#/$defs/Money" }, "reasoning": { "$ref": "#/$defs/Money" }, "input_audio": { "$ref": "#/$defs/Money" }, "input_image": { "$ref": "#/$defs/Money" }, "input_video": { "$ref": "#/$defs/Money" }, "output_audio": { "$ref": "#/$defs/Money" }, "output_image": { "$ref": "#/$defs/Money" }, "per_request": { "$ref": "#/$defs/Money" }, "per_audio_second_in": { "$ref": "#/$defs/Money" }, "per_1k_characters_in": { "$ref": "#/$defs/Money" }, "per_page": { "$ref": "#/$defs/Money" }, "per_web_search": { "$ref": "#/$defs/Money" }, "per_image": { "type": "object", "description": "\"/\" → USD.", "propertyNames": { "type": "string", "pattern": "^[^/]+/[^/]+$" }, "additionalProperties": { "$ref": "#/$defs/Money" } } }, "required": [ "above_input_tokens" ], "additionalProperties": false } }, "service_tiers": { "type": "object", "description": "Service tier name → multiplier of the token rates, applied when the upstream response (else the request) names that tier.", "additionalProperties": { "$ref": "#/$defs/Decimal" } }, "batch_multiplier": { "$ref": "#/$defs/Decimal", "description": "Multiplier of the token rates for usage settled from a Batches API job (for example \"0.5\"). Absent: 1." } }, "additionalProperties": false }, "CallPrice": { "type": "object", "description": "Price of an MCP tool or A2A agent call.", "properties": { "per_call": { "$ref": "#/$defs/Money" } }, "required": [ "per_call" ], "additionalProperties": false }, "Deployment": { "type": "object", "description": "A deployment (limits and price:).", "properties": { "provider": { "$ref": "#/$defs/ProviderName" }, "model": { "type": "string", "description": "Upstream model id (Azure: deployment name; Bedrock: model id, profile id or ARN).", "minLength": 1 }, "base_model": { "type": "string", "minLength": 1 }, "enabled": { "type": "boolean", "default": true }, "region": { "type": "string", "description": "The deployment's region (any provider type): the region allow-lists of match it; for bedrock also the signing and endpoint region, overriding providers.

.aws.region.", "minLength": 1 }, "location": { "type": "string", "description": "vertex only.", "minLength": 1 }, "vertex": { "type": "object", "properties": { "publisher": { "enum": [ "google", "anthropic" ] } }, "additionalProperties": false }, "bedrock": { "type": "object", "properties": { "api": { "enum": [ "auto", "converse", "invoke", "openai" ], "default": "auto" } }, "additionalProperties": false }, "default_max_tokens": { "type": "integer", "minimum": 1, "maximum": 10000000, "default": 4096 }, "byok": { "enum": [ "disabled", "allowed", "required" ] }, "headers": { "type": "object", "description": "Merged over the provider's.", "propertyNames": { "$ref": "#/$defs/ForwardableHeaderName" }, "additionalProperties": { "$ref": "#/$defs/HeaderValue" } }, "params": { "$ref": "#/$defs/Params" }, "capabilities": { "$ref": "#/$defs/Capabilities" }, "limits": { "type": "object", "description": "Deployment-scope limits.", "propertyNames": { "$ref": "#/$defs/LimitName" }, "additionalProperties": { "$ref": "#/$defs/Limit" } }, "price": { "$ref": "#/$defs/Price", "description": "; overrides pricing.models." } }, "required": [ "provider", "model" ], "additionalProperties": false }, "Streaming": { "type": "object", "description": "Top-level `streaming`: gateway-wide settings only.", "properties": { "max_event_bytes": { "$ref": "#/$defs/Size", "x-range": { "min": "64KiB", "max": "64MiB" }, "default": "16MiB" }, "send_buffer": { "$ref": "#/$defs/Size", "x-range": { "min": "64KiB", "max": "16MiB" }, "default": "1MiB" }, "client_write_timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "1s", "max": "300s" }, "default": "30s" } }, "additionalProperties": false }, "PolicyStreaming": { "type": "object", "description": "`policies.streaming` member.", "properties": { "commit": { "type": "object", "properties": { "max_hold": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s", "max": "60s" }, "default": "10s" }, "max_hold_events": { "type": "integer", "minimum": 1, "maximum": 1024, "default": 64 }, "max_hold_bytes": { "$ref": "#/$defs/Size", "x-range": { "min": "1KiB", "max": "4MiB" }, "default": "256KiB" } }, "additionalProperties": false }, "heartbeat": { "type": "object", "properties": { "interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "1s", "max": "300s" }, "default": "15s" }, "dialects": { "type": "array", "items": { "enum": [ "openai_chat", "openai_completions", "openai_responses", "anthropic_messages" ] }, "uniqueItems": true, "description": "Dialects that receive comment heartbeats; `gemini` and `bedrock` are rejected.", "default": [ "openai_chat", "openai_completions", "openai_responses", "anthropic_messages" ] } }, "additionalProperties": false }, "max_response_bytes": { "anyOf": [ { "$ref": "#/$defs/Size", "x-range": { "min": "1KiB", "max": "1GiB" } }, { "type": "null" } ], "default": null }, "on_client_disconnect": { "enum": [ "cancel", "complete" ], "default": "cancel" }, "allow": { "type": "boolean", "default": true }, "locked": { "$ref": "#/$defs/FieldPaths" }, "request_overridable": { "$ref": "#/$defs/FieldPaths" }, "stream_upstream": { "type": "boolean", "description": "Non-streaming client requests are sent to the upstream as streams and aggregated into one complete response.", "default": false } }, "additionalProperties": false }, "NodeParams": { "type": "object", "description": "Node and alias parameters.", "properties": { "set": { "type": "object", "description": "Free-form request parameters to set.", "default": {} }, "remove": { "type": "array", "description": "Dot paths.", "items": { "type": "string", "pattern": "^[^.\\s][^\\s]*$" }, "default": [] } }, "additionalProperties": false }, "UpstreamBody": { "type": "object", "description": "Leaf-only upstream body mutation.", "properties": { "set": { "type": "object", "propertyNames": { "$ref": "#/$defs/JsonPointer" }, "default": {} }, "remove": { "type": "array", "items": { "$ref": "#/$defs/JsonPointer" }, "default": [] } }, "additionalProperties": false }, "Selector": { "type": "string", "description": "Condition selector.", "pattern": "^(header\\.[!#$%&'*+.^_`|~0-9A-Za-z-]+|body\\..+|metadata\\..+|request\\.(endpoint|dialect|path|stream|input_tokens|max_output_tokens|has_tools|has_images|has_audio|model)|identity\\.(organization|team|project|key|end_user|tags)|guard\\.[a-z][a-z0-9_]*\\..+)$", "not": { "anyOf": [ { "pattern": "^header\\.([Aa][Uu][Tt][Hh][Oo][Rr][Ii][Zz][Aa][Tt][Ii][Oo][Nn]|[Xx]-[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Cc][Oo][Oo][Kk][Ii][Ee]|[Pp][Rr][Oo][Xx][Yy]-[Aa][Uu][Tt][Hh][Oo][Rr][Ii][Zz][Aa][Tt][Ii][Oo][Nn])$" }, { "allOf": [ { "pattern": "^header\\.[Xx]-[Aa][Nn][Tt][Ii][Rr][Ii][Oo][Nn]-" }, { "not": { "pattern": "^header\\.[Xx]-[Aa][Nn][Tt][Ii][Rr][Ii][Oo][Nn]-[Mm][Ee][Tt][Aa][Dd][Aa][Tt][Aa]$" } } ] } ] } }, "Predicate": { "type": "object", "description": "Predicate: all, any, not, or field plus exactly one operator; keys AND together.", "properties": { "all": { "type": "array", "items": { "$ref": "#/$defs/Predicate" } }, "any": { "type": "array", "items": { "$ref": "#/$defs/Predicate" }, "minItems": 1 }, "not": { "$ref": "#/$defs/Predicate" }, "field": { "$ref": "#/$defs/Selector" }, "eq": {}, "ne": {}, "in": { "type": "array" }, "nin": { "type": "array" }, "gt": { "type": [ "number", "string" ] }, "gte": { "type": [ "number", "string" ] }, "lt": { "type": [ "number", "string" ] }, "lte": { "type": [ "number", "string" ] }, "contains": {}, "regex": { "type": "string" }, "exists": { "type": "boolean" }, "sample": { "$ref": "#/$defs/Ratio", "description": "Deterministic fraction of requests, by request id." } }, "additionalProperties": false, "dependentRequired": { "eq": [ "field" ], "ne": [ "field" ], "in": [ "field" ], "nin": [ "field" ], "gt": [ "field" ], "gte": [ "field" ], "lt": [ "field" ], "lte": [ "field" ], "contains": [ "field" ], "regex": [ "field" ], "exists": [ "field" ] }, "if": { "required": [ "field" ] }, "then": { "oneOf": [ { "required": [ "eq" ] }, { "required": [ "ne" ] }, { "required": [ "in" ] }, { "required": [ "nin" ] }, { "required": [ "gt" ] }, { "required": [ "gte" ] }, { "required": [ "lt" ] }, { "required": [ "lte" ] }, { "required": [ "contains" ] }, { "required": [ "regex" ] }, { "required": [ "exists" ] } ] } }, "RoutingInput": { "type": "object", "description": "Routing text.", "properties": { "source": { "enum": [ "last_user_text", "user_window" ], "default": "last_user_text" }, "turns": { "type": "integer", "minimum": 1, "default": 1 }, "include_system": { "type": "boolean", "default": false }, "max_chars": { "type": "integer", "minimum": 256, "maximum": 1048576, "default": 16384 } }, "additionalProperties": false }, "Mirror": { "type": "object", "description": "Shadow traffic.", "properties": { "target": { "$ref": "#/$defs/Node" }, "fraction": { "$ref": "#/$defs/Ratio" }, "sample_by": { "enum": [ "request", "session" ], "default": "request" }, "max_in_flight": { "type": "integer", "minimum": 1, "maximum": 10000, "default": 64 } }, "required": [ "target", "fraction" ], "additionalProperties": false }, "Node_deployment": { "type": "object", "description": "A `deployment` node.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] }, "id": { "$ref": "#/$defs/NodeId" }, "params": { "$ref": "#/$defs/NodeParams", "default": {} }, "policies": { "$ref": "#/$defs/PoliciesNode", "default": {} }, "mirror": { "$ref": "#/$defs/Mirror" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 }, "deployment": { "$ref": "#/$defs/ProviderName" }, "upstream_body": { "$ref": "#/$defs/UpstreamBody", "default": {} }, "tags": { "type": "array", "description": "Tag filtering.", "items": { "$ref": "#/$defs/Tag" }, "default": [] } }, "required": [ "deployment" ], "additionalProperties": false }, "Node_provider_model": { "type": "object", "description": "A `provider_model` node.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] }, "id": { "$ref": "#/$defs/NodeId" }, "params": { "$ref": "#/$defs/NodeParams", "default": {} }, "policies": { "$ref": "#/$defs/PoliciesNode", "default": {} }, "mirror": { "$ref": "#/$defs/Mirror" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 }, "provider": { "$ref": "#/$defs/ProviderName" }, "upstream_model": { "type": "string", "description": "May use {model}, {1}–{9} under wildcard Models.", "minLength": 1 }, "upstream_body": { "$ref": "#/$defs/UpstreamBody", "default": {} }, "tags": { "type": "array", "description": "Tag filtering.", "items": { "$ref": "#/$defs/Tag" }, "default": [] } }, "required": [ "provider", "upstream_model" ], "additionalProperties": false }, "Node_route": { "type": "object", "description": "A `route` node.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] }, "id": { "$ref": "#/$defs/NodeId" }, "params": { "$ref": "#/$defs/NodeParams", "default": {} }, "policies": { "$ref": "#/$defs/PoliciesNode", "default": {} }, "mirror": { "$ref": "#/$defs/Mirror" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 }, "route": { "$ref": "#/$defs/Name" } }, "required": [ "route" ], "additionalProperties": false }, "Node_fallback": { "type": "object", "description": "A `fallback` node.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] }, "id": { "$ref": "#/$defs/NodeId" }, "params": { "$ref": "#/$defs/NodeParams", "default": {} }, "policies": { "$ref": "#/$defs/PoliciesNode", "default": {} }, "mirror": { "$ref": "#/$defs/Mirror" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 }, "children": { "type": "array", "items": { "$ref": "#/$defs/Node" }, "minItems": 1 } }, "required": [ "children" ], "additionalProperties": false }, "Node_weighted": { "type": "object", "description": "A `weighted` node.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] }, "id": { "$ref": "#/$defs/NodeId" }, "params": { "$ref": "#/$defs/NodeParams", "default": {} }, "policies": { "$ref": "#/$defs/PoliciesNode", "default": {} }, "mirror": { "$ref": "#/$defs/Mirror" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 }, "children": { "type": "array", "items": { "$ref": "#/$defs/WeightedChild" }, "minItems": 1 }, "algorithm": { "enum": [ "smooth_wrr", "random", "thompson" ], "default": "smooth_wrr" }, "sticky_by": { "type": "string", "pattern": "^(session|end_user|key|header:[!#$%&'*+.^_`|~0-9A-Za-z-]+|metadata:.+)$" }, "experiment": { "type": "string", "minLength": 1 }, "expose": { "type": "boolean", "default": false }, "min_samples_per_arm": { "type": "integer", "description": "Bandit nursery: feedback samples each arm takes in turn before Thompson sampling.", "minimum": 1, "default": 10 }, "metric": { "type": "string", "minLength": 1, "description": "Algorithm thompson only: the feedback metric whose values are the rewards; a boolean metric, or a number metric with min and max." }, "arms": { "type": "array", "description": "Algorithm thompson only: the arms (child ids) the bandit chooses among. Absent: every child with a weight above 0.", "items": { "$ref": "#/$defs/NodeId" }, "minItems": 2, "uniqueItems": true }, "stop_after": { "type": "object", "description": "Algorithm thompson only: once an arm's posterior probability of being the best exceeds 1 − delta, every later request goes to it.", "properties": { "delta": { "type": "number", "exclusiveMinimum": 0, "maximum": 0.5, "default": 0.05 } }, "additionalProperties": false }, "canary": { "type": "object", "properties": { "child": { "$ref": "#/$defs/NodeId" }, "steps": { "type": "array", "items": { "type": "object", "properties": { "weight": { "$ref": "#/$defs/Weight" }, "after": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" } } }, "required": [ "weight", "after" ], "additionalProperties": false }, "minItems": 1, "maxItems": 20 }, "error_budget": { "type": "object", "properties": { "max_error_rate": { "$ref": "#/$defs/Ratio" }, "window": { "$ref": "#/$defs/Duration", "x-range": { "min": "30s", "max": "1h" }, "default": "5m" }, "action": { "enum": [ "rollback", "hold" ], "default": "rollback" } }, "required": [ "max_error_rate" ], "additionalProperties": false } }, "required": [ "child" ], "additionalProperties": false } }, "required": [ "children" ], "additionalProperties": false, "allOf": [ { "dependentRequired": { "expose": [ "experiment" ] } } ] }, "Node_least_latency": { "type": "object", "description": "A `least_latency` node.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] }, "id": { "$ref": "#/$defs/NodeId" }, "params": { "$ref": "#/$defs/NodeParams", "default": {} }, "policies": { "$ref": "#/$defs/PoliciesNode", "default": {} }, "mirror": { "$ref": "#/$defs/Mirror" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 }, "children": { "type": "array", "items": { "$ref": "#/$defs/Node" }, "minItems": 1 }, "decay": { "$ref": "#/$defs/Duration", "x-range": { "min": "100ms", "max": "10m" } }, "default_estimate": { "$ref": "#/$defs/LatencyEstimate" } }, "required": [ "children" ], "additionalProperties": false }, "Node_least_busy": { "type": "object", "description": "A `least_busy` node.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] }, "id": { "$ref": "#/$defs/NodeId" }, "params": { "$ref": "#/$defs/NodeParams", "default": {} }, "policies": { "$ref": "#/$defs/PoliciesNode", "default": {} }, "mirror": { "$ref": "#/$defs/Mirror" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 }, "children": { "type": "array", "items": { "$ref": "#/$defs/WeightedChild" }, "minItems": 1 }, "scope": { "enum": [ "replica", "cluster" ], "default": "replica" } }, "required": [ "children" ], "additionalProperties": false }, "Node_least_cost": { "type": "object", "description": "A `least_cost` node.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] }, "id": { "$ref": "#/$defs/NodeId" }, "params": { "$ref": "#/$defs/NodeParams", "default": {} }, "policies": { "$ref": "#/$defs/PoliciesNode", "default": {} }, "mirror": { "$ref": "#/$defs/Mirror" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 }, "children": { "type": "array", "items": { "$ref": "#/$defs/Node" }, "minItems": 1 } }, "required": [ "children" ], "additionalProperties": false }, "Node_conditional": { "type": "object", "description": "A `conditional` node.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] }, "id": { "$ref": "#/$defs/NodeId" }, "params": { "$ref": "#/$defs/NodeParams", "default": {} }, "policies": { "$ref": "#/$defs/PoliciesNode", "default": {} }, "mirror": { "$ref": "#/$defs/Mirror" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 }, "rules": { "type": "array", "items": { "type": "object", "properties": { "when": { "$ref": "#/$defs/Predicate" }, "target": { "$ref": "#/$defs/Node" }, "name": { "type": "string", "minLength": 1, "maxLength": 100 }, "description": { "type": "string", "maxLength": 500 }, "tags": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 64 }, "maxItems": 16, "default": [] }, "enabled": { "type": "boolean", "default": true } }, "required": [ "target" ], "additionalProperties": false }, "minItems": 1 }, "default": { "$ref": "#/$defs/Node" } }, "required": [ "rules" ], "additionalProperties": false }, "Node_classifier": { "type": "object", "description": "A `classifier` node.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] }, "id": { "$ref": "#/$defs/NodeId" }, "params": { "$ref": "#/$defs/NodeParams", "default": {} }, "policies": { "$ref": "#/$defs/PoliciesNode", "default": {} }, "mirror": { "$ref": "#/$defs/Mirror" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 }, "kind": { "enum": [ "keyword", "regex", "embedding", "llm", "external" ] }, "classes": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1 }, "target": { "$ref": "#/$defs/Node" }, "keywords": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 }, "patterns": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 }, "examples": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 }, "threshold": { "$ref": "#/$defs/Ratio" }, "description": { "type": "string" } }, "required": [ "name", "target" ], "additionalProperties": false }, "minItems": 1 }, "default": { "$ref": "#/$defs/Node" }, "input": { "$ref": "#/$defs/RoutingInput", "default": { "source": "last_user_text", "turns": 1, "include_system": false, "max_chars": 16384 } }, "threshold": { "$ref": "#/$defs/Ratio", "default": 0.75 }, "embedding": { "type": "object", "properties": { "model": { "$ref": "#/$defs/ModelName" }, "cache_entries": { "type": "integer", "minimum": 1, "default": 10000 } }, "required": [ "model" ], "additionalProperties": false }, "llm": { "type": "object", "properties": { "model": { "$ref": "#/$defs/ModelName" }, "max_tokens": { "type": "integer", "minimum": 1, "default": 16 } }, "required": [ "model" ], "additionalProperties": false }, "external": { "type": "object", "properties": { "url": { "$ref": "#/$defs/HttpsUrl" }, "headers": { "$ref": "#/$defs/HeaderValues" } }, "required": [ "url" ], "additionalProperties": false }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "10ms", "max": "30s" }, "default": "500ms" }, "on_error": { "enum": [ "default", "reject" ], "default": "default" }, "continuation": { "enum": [ "replay", "classify" ], "default": "classify" } }, "required": [ "kind", "classes", "default" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "kind": { "const": "keyword" } }, "required": [ "kind" ] }, "then": { "properties": { "classes": { "items": { "required": [ "keywords" ], "properties": { "patterns": false, "examples": false } } } } } }, { "if": { "properties": { "kind": { "const": "regex" } }, "required": [ "kind" ] }, "then": { "properties": { "classes": { "items": { "required": [ "patterns" ], "properties": { "keywords": false, "examples": false } } } } } }, { "if": { "properties": { "kind": { "const": "embedding" } }, "required": [ "kind" ] }, "then": { "properties": { "classes": { "items": { "required": [ "examples" ], "properties": { "keywords": false, "patterns": false } } } } } } ] }, "Node_cost_quality": { "type": "object", "description": "A `cost_quality` node.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] }, "id": { "$ref": "#/$defs/NodeId" }, "params": { "$ref": "#/$defs/NodeParams", "default": {} }, "policies": { "$ref": "#/$defs/PoliciesNode", "default": {} }, "mirror": { "$ref": "#/$defs/Mirror" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 }, "strong": { "$ref": "#/$defs/Node" }, "weak": { "$ref": "#/$defs/Node" }, "threshold": { "$ref": "#/$defs/Ratio" }, "strong_fraction": { "$ref": "#/$defs/Ratio" }, "calibration": { "type": "object", "properties": { "window": { "type": "integer", "minimum": 100, "maximum": 1000000, "default": 10000 }, "min_samples": { "type": "integer", "minimum": 1, "default": 200 }, "initial_threshold": { "$ref": "#/$defs/Ratio", "default": 0.5 } }, "additionalProperties": false }, "scorer": { "type": "object", "required": [ "kind" ], "description": "Scorer. `external`: `url` and `headers`; `llm`: `model` and `max_tokens`; `classifier`: `match` and `classes`; `matrix_factorization`: `model_file`, `embedding_model` and `models`; `random` takes no other field.", "properties": { "kind": { "enum": [ "random", "external", "classifier", "llm", "matrix_factorization" ] }, "url": { "$ref": "#/$defs/HttpsUrl" }, "headers": { "$ref": "#/$defs/HeaderValues" }, "model": { "$ref": "#/$defs/ModelName" }, "max_tokens": { "type": "integer", "minimum": 1, "default": 16 }, "match": { "enum": [ "keyword", "regex" ], "default": "keyword" }, "classes": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1 }, "keywords": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 }, "patterns": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 } }, "required": [ "name" ], "additionalProperties": false }, "minItems": 1 }, "model_file": { "type": "string", "minLength": 1, "description": "matrix_factorization: the pre-trained model file (JSON: `models`, `projection`, `classifier`), read when the configuration is applied." }, "embedding_model": { "$ref": "#/$defs/ModelName", "description": "matrix_factorization: the embeddings Model that embeds the routing text." }, "models": { "type": "object", "description": "matrix_factorization: the scoring pair, by their names in the model file.", "properties": { "strong": { "type": "string", "minLength": 1 }, "weak": { "type": "string", "minLength": 1 } }, "required": [ "strong", "weak" ], "additionalProperties": false } }, "allOf": [ { "if": { "properties": { "kind": { "const": "matrix_factorization" } }, "required": [ "kind" ] }, "then": { "required": [ "model_file", "embedding_model", "models" ] } }, { "if": { "properties": { "kind": { "const": "external" } }, "required": [ "kind" ] }, "then": { "required": [ "url" ] } }, { "if": { "properties": { "kind": { "const": "llm" } }, "required": [ "kind" ] }, "then": { "required": [ "model" ] } }, { "if": { "properties": { "kind": { "const": "classifier" } }, "required": [ "kind" ] }, "then": { "required": [ "classes" ] } } ] }, "input": { "$ref": "#/$defs/RoutingInput", "default": { "source": "last_user_text", "turns": 1, "include_system": false, "max_chars": 16384 } }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "10ms", "max": "30s" }, "default": "300ms" }, "on_error": { "enum": [ "strong", "weak", "reject" ], "default": "strong" } }, "required": [ "strong", "weak", "scorer" ], "additionalProperties": false, "allOf": [ { "oneOf": [ { "required": [ "threshold" ] }, { "required": [ "strong_fraction" ] } ], "description": "Exactly one of threshold / strong_fraction." } ] }, "Node_pool": { "type": "object", "description": "A `pool` node.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] }, "id": { "$ref": "#/$defs/NodeId" }, "params": { "$ref": "#/$defs/NodeParams", "default": {} }, "policies": { "$ref": "#/$defs/PoliciesNode", "default": {} }, "mirror": { "$ref": "#/$defs/Mirror" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 }, "children": { "type": "array", "items": { "$ref": "#/$defs/Node" }, "minItems": 1 }, "metrics": { "type": "object", "properties": { "path": { "type": "string", "pattern": "^/", "default": "/metrics" }, "interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "50ms", "max": "60s" }, "default": "250ms" }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "200ms" }, "names": { "description": "Metric-name preset (`vllm`, `sglang`) or explicit names.", "anyOf": [ { "enum": [ "vllm", "sglang" ] }, { "type": "object", "properties": { "waiting": { "type": "string" }, "running": { "type": "string" }, "kv": { "type": "string" }, "lora": { "type": "string" } }, "additionalProperties": false } ], "default": "vllm" } }, "additionalProperties": false }, "scheduler": { "type": "object", "properties": { "queue_slack": { "type": "integer", "minimum": 0, "default": 8 }, "kv_cache_limit": { "type": "number", "exclusiveMinimum": 0, "maximum": 1, "default": 0.9 }, "weights": { "type": "object", "properties": { "prefix": { "type": "number", "minimum": 0, "default": 2 }, "queue": { "type": "number", "minimum": 0, "default": 1 }, "kv": { "type": "number", "minimum": 0, "default": 1 } }, "additionalProperties": false }, "prefix": { "type": "object", "properties": { "chunk_chars": { "type": "integer", "minimum": 1, "default": 256 }, "max_chunks": { "type": "integer", "minimum": 1, "default": 128 }, "entries": { "type": "integer", "minimum": 1, "default": 100000 } }, "additionalProperties": false }, "lora": { "type": "boolean", "default": false } }, "additionalProperties": false }, "picker": { "enum": [ "builtin", "external" ], "default": "builtin" }, "picker_on_error": { "enum": [ "reject", "builtin" ], "default": "reject" }, "picker_service": { "type": "object", "description": "The endpoint picker of `picker: external`: a gRPC service speaking the external-processing protocol, over HTTP/2 (cleartext for an http URL).", "properties": { "url": { "$ref": "#/$defs/HttpsUrl" }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "10ms", "max": "30s" }, "default": "300ms" } }, "required": [ "url" ], "additionalProperties": false } }, "required": [ "children" ], "additionalProperties": false, "allOf": [ { "if": { "required": [ "picker_on_error" ] }, "then": { "required": [ "picker" ], "properties": { "picker": { "const": "external" } } } }, { "if": { "required": [ "picker_service" ] }, "then": { "required": [ "picker" ], "properties": { "picker": { "const": "external" } } } }, { "if": { "required": [ "picker" ], "properties": { "picker": { "const": "external" } } }, "then": { "required": [ "picker_service" ] } } ] }, "NodeObject": { "type": "object", "description": "A route-tree node object, dispatched on `type`; `type` is inferred as `deployment` when `deployment` is set, `route` when `route` is set, and is required otherwise.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] } }, "if": { "required": [ "type" ] }, "then": { "allOf": [ { "if": { "properties": { "type": { "const": "deployment" } }, "required": [ "type" ] }, "then": { "$ref": "#/$defs/Node_deployment" } }, { "if": { "properties": { "type": { "const": "provider_model" } }, "required": [ "type" ] }, "then": { "$ref": "#/$defs/Node_provider_model" } }, { "if": { "properties": { "type": { "const": "route" } }, "required": [ "type" ] }, "then": { "$ref": "#/$defs/Node_route" } }, { "if": { "properties": { "type": { "const": "fallback" } }, "required": [ "type" ] }, "then": { "$ref": "#/$defs/Node_fallback" } }, { "if": { "properties": { "type": { "const": "weighted" } }, "required": [ "type" ] }, "then": { "$ref": "#/$defs/Node_weighted" } }, { "if": { "properties": { "type": { "const": "least_latency" } }, "required": [ "type" ] }, "then": { "$ref": "#/$defs/Node_least_latency" } }, { "if": { "properties": { "type": { "const": "least_busy" } }, "required": [ "type" ] }, "then": { "$ref": "#/$defs/Node_least_busy" } }, { "if": { "properties": { "type": { "const": "least_cost" } }, "required": [ "type" ] }, "then": { "$ref": "#/$defs/Node_least_cost" } }, { "if": { "properties": { "type": { "const": "conditional" } }, "required": [ "type" ] }, "then": { "$ref": "#/$defs/Node_conditional" } }, { "if": { "properties": { "type": { "const": "classifier" } }, "required": [ "type" ] }, "then": { "$ref": "#/$defs/Node_classifier" } }, { "if": { "properties": { "type": { "const": "cost_quality" } }, "required": [ "type" ] }, "then": { "$ref": "#/$defs/Node_cost_quality" } }, { "if": { "properties": { "type": { "const": "pool" } }, "required": [ "type" ] }, "then": { "$ref": "#/$defs/Node_pool" } }, { "if": { "properties": { "type": { "const": "tier" } }, "required": [ "type" ] }, "then": { "$ref": "#/$defs/Node_tier" } }, { "if": { "properties": { "type": { "const": "block" } }, "required": [ "type" ] }, "then": { "$ref": "#/$defs/Node_block" } } ] }, "else": { "if": { "required": [ "deployment" ] }, "then": { "$ref": "#/$defs/Node_deployment" }, "else": { "if": { "required": [ "route" ] }, "then": { "$ref": "#/$defs/Node_route" }, "else": { "required": [ "type" ] } } } }, "WeightedChild": { "description": "A child of a `weighted` or `least_busy` node: a node object that may carry `weight`, or a bare deployment name.", "if": { "type": "string" }, "then": { "$ref": "#/$defs/ProviderName" }, "else": { "$ref": "#/$defs/NodeObject" } }, "Node": { "description": "A node, or a bare deployment name as shorthand for {type: deployment, deployment: }. `weight` is allowed only on children of `weighted` and `least_busy`.", "$ref": "#/$defs/WeightedChild", "properties": { "weight": false } }, "Model": { "type": "object", "description": "A public Model.", "properties": { "route": { "$ref": "#/$defs/Name" }, "target": { "$ref": "#/$defs/Node" }, "visibility": { "enum": [ "public", "internal" ], "default": "public" }, "aliases": { "type": "object", "propertyNames": { "$ref": "#/$defs/AliasName" }, "additionalProperties": { "type": "object", "properties": { "params": { "$ref": "#/$defs/NodeParams", "default": {} }, "description": { "type": "string", "maxLength": 500 }, "owner": { "$ref": "#/$defs/TenantName" } }, "additionalProperties": false }, "default": {} }, "description": { "type": "string", "maxLength": 1024, "default": "" }, "owned_by": { "type": "string", "minLength": 1, "maxLength": 128, "default": "antirion" }, "enabled": { "type": "boolean", "default": true }, "policies": { "$ref": "#/$defs/PoliciesModelRoute", "default": {} }, "tier": { "$ref": "#/$defs/Tier" }, "lifecycle": { "type": "object", "properties": { "state": { "enum": [ "preview", "ga", "restricted", "deprecated" ], "default": "ga" }, "eol_at": { "$ref": "#/$defs/RfcTime" }, "replacement": { "$ref": "#/$defs/ModelName" } }, "additionalProperties": false }, "access": { "type": "object", "description": "Who may use a preview or restricted Model.", "properties": { "organizations": { "type": "array", "items": { "$ref": "#/$defs/TenantName" }, "default": [] }, "teams": { "type": "array", "items": { "$ref": "#/$defs/TenantName" }, "default": [] }, "projects": { "type": "array", "items": { "$ref": "#/$defs/TenantName" }, "default": [] }, "keys": { "type": "array", "items": { "$ref": "#/$defs/Name" }, "default": [] } }, "additionalProperties": false }, "display_name": { "type": "string", "minLength": 1, "maxLength": 200 }, "labels": { "type": "array", "items": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._:-]{0,63}$" }, "uniqueItems": true, "maxItems": 32, "default": [] }, "catalog": { "type": "object", "properties": { "family": { "type": "string", "minLength": 1, "maxLength": 100 }, "version": { "type": "string", "minLength": 1, "maxLength": 100 }, "revision": { "type": "string", "minLength": 1, "maxLength": 100 }, "released_at": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$" } }, "additionalProperties": false }, "annotations": { "$ref": "#/$defs/Metadata", "default": {} } }, "additionalProperties": false, "oneOf": [ { "required": [ "route" ] }, { "required": [ "target" ] } ] }, "Route": { "type": "object", "description": "A Route.", "properties": { "tree": { "$ref": "#/$defs/Node" }, "policies": { "$ref": "#/$defs/PoliciesModelRoute" }, "enabled": { "type": "boolean", "description": "false keeps the route validated and referenceable, and no request is routed through it: a Model it serves answers 503 no_healthy_deployment with reason route_disabled, a tree node that references it is never a position (a fallback goes on to its next child, as past a disabled deployment), and a tier leaves out the Models it serves.", "default": true }, "affinity": { "type": "object", "properties": { "session": { "type": "boolean", "default": true }, "mode": { "enum": [ "prefer", "strict" ], "default": "prefer" }, "sources": { "type": "array", "items": { "type": "string", "pattern": "^(header:[!#$%&'*+.^_`|~0-9A-Za-z-]+|body:[^\\s]+)$" }, "minItems": 1, "maxItems": 16 }, "prompt_prefix": { "type": "boolean", "default": false }, "scope": { "enum": [ "project", "key", "organization" ], "default": "project" }, "ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "1s", "max": "30d" } } }, "additionalProperties": false }, "tag_filter": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": false }, "default_tag": { "$ref": "#/$defs/Tag", "default": "default" } }, "additionalProperties": false }, "on_all_unhealthy": { "enum": [ "reject", "ignore_health" ] } }, "required": [ "tree" ], "additionalProperties": false }, "Routing": { "type": "object", "description": "Top-level `routing`.", "properties": { "default_models": { "type": "object", "description": "Endpoint → Model used when a request has none.", "propertyNames": { "enum": [ "chat_completions", "responses", "completions", "embeddings", "images", "audio", "moderations", "batches", "realtime", "rerank" ] }, "additionalProperties": { "$ref": "#/$defs/ModelName" }, "default": {} }, "provider_addressing": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": true }, "types": { "type": "object", "propertyNames": { "$ref": "#/$defs/ProviderType" }, "additionalProperties": { "$ref": "#/$defs/ProviderName" }, "default": {} } }, "additionalProperties": false }, "hash_seed": { "description": "Secret reference or 64-bit integer.", "anyOf": [ { "$ref": "#/$defs/Secret" }, { "type": "integer", "minimum": 0, "maximum": 18446744073709551615 } ] }, "cost_output_estimate": { "type": "integer", "minimum": 1, "maximum": 1000000, "default": 512 }, "latency": { "type": "object", "properties": { "decay": { "$ref": "#/$defs/Duration", "x-range": { "min": "100ms", "max": "10m" }, "default": "10s" }, "default_estimate": { "$ref": "#/$defs/LatencyEstimate", "default": { "ttft": "500ms", "per_token": "50ms", "e2e": "500ms" } } }, "additionalProperties": false }, "affinity": { "type": "object", "properties": { "ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "1s", "max": "30d" }, "default": "1h" }, "max_entries": { "type": "integer", "minimum": 1000, "maximum": 100000000, "default": 100000 }, "sources": { "type": "array", "items": { "type": "string", "pattern": "^(header:[!#$%&'*+.^_`|~0-9A-Za-z-]+|body:[^\\s]+)$" }, "minItems": 1, "maxItems": 16, "default": [ "header:x-antirion-session-id", "body:prompt_cache_key", "header:x-claude-code-session-id", "body:metadata.user_id" ] } }, "additionalProperties": false }, "metadata_max_size": { "$ref": "#/$defs/Size", "x-range": { "min": "1KiB", "max": "64KiB" }, "default": "8KiB" }, "expose_route_path": { "type": "boolean", "default": true }, "tiers": { "type": "object", "description": "Custom tiers. Built-in tiers need no declaration.", "propertyNames": { "type": "string", "description": "A built-in tier (frontier, balanced, fast, specialized) or one declared in routing.tiers.", "pattern": "^[a-z][a-z0-9_-]{0,31}$" }, "additionalProperties": { "type": "object", "properties": { "description": { "type": "string", "maxLength": 500 } }, "additionalProperties": false }, "default": {} }, "dry_run_all": { "type": "boolean", "default": false } }, "additionalProperties": false }, "PolicyResilience": { "type": "object", "description": "`policies.resilience` member.", "properties": { "retry": { "type": "object", "properties": { "max_attempts": { "type": "integer", "description": "Rejected above 10, never clamped.", "minimum": 1, "maximum": 10, "default": 5 }, "tier_retries": { "type": "integer", "description": "≤ max_attempts − 1.", "minimum": 0, "maximum": 9, "default": 2 }, "min_attempt_time": { "$ref": "#/$defs/Duration", "x-range": { "min": "1ms" }, "default": "1s" }, "retry_after_max_wait": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" }, "default": "10s" }, "backoff": { "type": "object", "properties": { "initial": { "$ref": "#/$defs/Duration", "x-range": { "min": "1ms" }, "default": "500ms" }, "max": { "$ref": "#/$defs/Duration", "description": "≥ initial.", "default": "8s" }, "multiplier": { "type": "number", "minimum": 1, "maximum": 10, "default": 2 }, "jitter": { "$ref": "#/$defs/Ratio", "default": 0.5 } }, "additionalProperties": false }, "fallback": { "type": "boolean", "default": true }, "class_fallbacks": { "type": "object", "properties": { "context_length": { "anyOf": [ { "$ref": "#/$defs/ModelName" }, { "type": "null" } ], "default": null }, "content_policy": { "anyOf": [ { "$ref": "#/$defs/ModelName" }, { "type": "null" } ], "default": null } }, "additionalProperties": false }, "classes": { "type": "object", "description": "Per-class overrides; fixed classes accept none.", "propertyNames": { "enum": [ "dns_error", "connect_error", "connect_timeout", "tls_error", "refused_stream", "upstream_reset", "timeout", "rate_limited", "quota_exhausted", "credential_rejected", "overloaded", "server_error", "not_implemented", "model_unavailable", "malformed_response", "conflict", "reasoning_replay_rejected" ] }, "additionalProperties": { "type": "object", "properties": { "actions": { "type": "array", "items": { "enum": [ "rotate_key", "next_deployment", "retry_same" ] }, "uniqueItems": true }, "retry_same_any_key": { "type": "boolean", "description": "Meaningful for `timeout` only." } }, "additionalProperties": false }, "default": {} }, "retry_on_response": { "type": "array", "description": "Predicates over a 2xx answer; one that matches makes the attempt a `server_error` whose only action is the next deployment, never counted toward health. `header`/`equals` is read from the response head; `finish_reason` and `empty_content` need the whole answer, so they apply to complete (non-streaming) responses.", "items": { "type": "object", "properties": { "header": { "type": "string", "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$" }, "equals": { "type": "string" }, "finish_reason": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 }, "empty_content": { "const": true } }, "additionalProperties": false, "oneOf": [ { "required": [ "header", "equals" ], "properties": { "finish_reason": false, "empty_content": false } }, { "required": [ "finish_reason" ], "properties": { "header": false, "equals": false, "empty_content": false } }, { "required": [ "empty_content" ], "properties": { "header": false, "equals": false, "finish_reason": false } } ] }, "default": [] } }, "additionalProperties": false }, "timeouts": { "type": "object", "properties": { "connect": { "$ref": "#/$defs/Duration", "x-range": { "min": "1ms" }, "default": "10s" }, "response_headers": { "$ref": "#/$defs/DurationOrNone", "x-range": { "min": "1ms" }, "default": "60s" }, "ttft": { "$ref": "#/$defs/DurationOrNone", "x-range": { "min": "1ms" }, "default": "300s" }, "stream_idle": { "$ref": "#/$defs/DurationOrNone", "x-range": { "min": "1ms" }, "default": "120s" }, "attempt": { "$ref": "#/$defs/DurationOrNone", "x-range": { "min": "1ms" }, "default": "600s" }, "deadline": { "$ref": "#/$defs/DurationOrNone", "description": "≥ connect, or none.", "default": "900s" }, "stream_total": { "$ref": "#/$defs/DurationOrNone", "x-range": { "min": "1ms" }, "default": "none" } }, "additionalProperties": false }, "hedging": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": false }, "delay": { "$ref": "#/$defs/Duration", "x-range": { "min": "10ms" }, "default": "2s" }, "max_extra": { "type": "integer", "minimum": 1, "maximum": 2, "default": 1 } }, "additionalProperties": false }, "locked": { "$ref": "#/$defs/FieldPaths", "default": [] }, "request_overridable": { "$ref": "#/$defs/FieldPaths", "default": [ "timeouts.deadline", "retry.max_attempts", "retry.fallback" ] } }, "additionalProperties": false }, "Resilience": { "type": "object", "description": "Top-level `resilience`: gateway-wide health, classification and exposure; never inside policies.", "properties": { "health": { "type": "object", "properties": { "breaker": { "$ref": "#/$defs/Breaker" }, "max_cooldown": { "$ref": "#/$defs/Duration", "x-range": { "min": "1ms" }, "default": "300s" }, "rate_limit_cooldown": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" }, "default": "5s" }, "cooldown_buffer": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" }, "default": "0s" }, "dead_key_recheck": { "$ref": "#/$defs/Duration", "x-range": { "min": "1ms" }, "default": "5m" }, "max_dead_key_recheck": { "$ref": "#/$defs/Duration", "description": "≥ dead_key_recheck.", "default": "1h" }, "all_unhealthy": { "enum": [ "fail", "ignore_health" ], "default": "fail" }, "active_checks": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": false }, "interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "100ms" }, "default": "10s" }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "1ms" }, "default": "5s" }, "request": { "enum": [ "models_list", "minimal_generation" ], "default": "models_list" }, "when": { "enum": [ "open_only", "always" ], "default": "open_only" } }, "additionalProperties": false } }, "additionalProperties": false }, "health_overrides": { "type": "object", "description": "Deployment → any subset of `health` except active_checks.request.", "propertyNames": { "$ref": "#/$defs/ProviderName" }, "additionalProperties": { "type": "object", "properties": { "breaker": { "$ref": "#/$defs/Breaker" }, "max_cooldown": { "$ref": "#/$defs/Duration", "x-range": { "min": "1ms" } }, "rate_limit_cooldown": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" } }, "cooldown_buffer": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" } }, "dead_key_recheck": { "$ref": "#/$defs/Duration", "x-range": { "min": "1ms" } }, "max_dead_key_recheck": { "$ref": "#/$defs/Duration", "description": "≥ dead_key_recheck." }, "all_unhealthy": { "enum": [ "fail", "ignore_health" ] }, "active_checks": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "100ms" } }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "1ms" } }, "when": { "enum": [ "open_only", "always" ] } }, "additionalProperties": false } }, "additionalProperties": false }, "default": {} }, "classification": { "type": "object", "properties": { "status_overrides": { "type": "object", "propertyNames": { "type": "string", "pattern": "^(1[0-9]{2}|[3-5][0-9]{2})$" }, "additionalProperties": { "enum": [ "dns_error", "connect_error", "connect_timeout", "tls_error", "refused_stream", "upstream_reset", "timeout", "rate_limited", "quota_exhausted", "credential_rejected", "overloaded", "server_error", "not_implemented", "model_unavailable", "malformed_response", "conflict", "context_length", "content_policy", "reasoning_replay_rejected", "caller_error", "guardrail_blocked", "client_cancelled" ] }, "properties": { "400": { "enum": [ "caller_error", "context_length", "content_policy" ] }, "404": { "enum": [ "caller_error", "context_length", "content_policy" ] }, "413": { "enum": [ "caller_error", "context_length", "content_policy" ] }, "422": { "enum": [ "caller_error", "context_length", "content_policy" ] } }, "description": "\"NNN\" → class; never 2xx; 400/404/413/422 only to caller_error, context_length or content_policy.", "default": {} } }, "additionalProperties": false }, "exposure": { "type": "object", "properties": { "attempt_trail": { "enum": [ "off", "on_request", "always" ], "default": "on_request" } }, "additionalProperties": false }, "retry_budget": { "type": "object", "description": "Retries onto a deployment are capped per node at max(10 s × min_per_second, ratio × first attempts) over a sliding 10 s window.", "properties": { "ratio": { "$ref": "#/$defs/Ratio", "default": 0.2 }, "min_per_second": { "type": "integer", "minimum": 0, "default": 10 } }, "additionalProperties": false } }, "additionalProperties": false }, "Organization": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": true }, "models": { "type": "array", "items": { "$ref": "#/$defs/ModelPattern" } }, "deny_models": { "type": "array", "items": { "$ref": "#/$defs/ModelPattern" } }, "providers": { "type": "array", "items": { "$ref": "#/$defs/NamePattern" } }, "deny_providers": { "type": "array", "items": { "$ref": "#/$defs/NamePattern" } }, "deployments": { "type": "array", "items": { "$ref": "#/$defs/NamePattern" } }, "endpoints": { "type": "array", "items": { "$ref": "#/$defs/EndpointFamily" } }, "allowed_ips": { "type": "array", "items": { "anyOf": [ { "$ref": "#/$defs/Cidr" }, { "$ref": "#/$defs/IpSetRef" } ] } }, "tags": { "type": "array", "items": { "$ref": "#/$defs/Tag" } }, "metadata": { "$ref": "#/$defs/Metadata" }, "policies": { "$ref": "#/$defs/PoliciesTenant" }, "display_name": { "type": "string", "maxLength": 200 }, "max_key_lifetime": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } }, "regions": { "type": "array", "items": { "$ref": "#/$defs/Region" } }, "deny_regions": { "type": "array", "items": { "$ref": "#/$defs/Region" } }, "key_policy": { "$ref": "#/$defs/KeyPolicy" }, "local_login": { "type": "boolean", "default": true }, "logo": { "type": "string", "minLength": 1, "maxLength": 90000, "description": "An https URL, or a data: URI of a PNG, JPEG or WebP image ≤ 64 KiB.", "pattern": "^(https://|data:image/(png|jpeg|webp);base64,)" }, "timezone": { "type": "string", "minLength": 1, "maxLength": 64, "description": "IANA time zone for the console's default display.", "pattern": "^[A-Za-z_]+(/[A-Za-z0-9_+-]+)*$" } }, "additionalProperties": false }, "Team": { "type": "object", "properties": { "organization": { "$ref": "#/$defs/TenantName" }, "enabled": { "type": "boolean", "default": true }, "models": { "type": "array", "items": { "$ref": "#/$defs/ModelPattern" } }, "deny_models": { "type": "array", "items": { "$ref": "#/$defs/ModelPattern" } }, "providers": { "type": "array", "items": { "$ref": "#/$defs/NamePattern" } }, "deny_providers": { "type": "array", "items": { "$ref": "#/$defs/NamePattern" } }, "deployments": { "type": "array", "items": { "$ref": "#/$defs/NamePattern" } }, "endpoints": { "type": "array", "items": { "$ref": "#/$defs/EndpointFamily" } }, "allowed_ips": { "type": "array", "items": { "anyOf": [ { "$ref": "#/$defs/Cidr" }, { "$ref": "#/$defs/IpSetRef" } ] } }, "tags": { "type": "array", "items": { "$ref": "#/$defs/Tag" } }, "metadata": { "$ref": "#/$defs/Metadata" }, "policies": { "$ref": "#/$defs/PoliciesTenant" }, "max_key_lifetime": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } }, "regions": { "type": "array", "items": { "$ref": "#/$defs/Region" } }, "deny_regions": { "type": "array", "items": { "$ref": "#/$defs/Region" } }, "key_policy": { "$ref": "#/$defs/KeyPolicy" }, "display_name": { "type": "string", "minLength": 1, "maxLength": 200 }, "color": { "type": "string", "pattern": "^#[0-9a-fA-F]{6}$" }, "lead": { "$ref": "#/$defs/UserName" } }, "required": [ "organization" ], "additionalProperties": false }, "Project": { "type": "object", "properties": { "team": { "$ref": "#/$defs/TenantName" }, "enabled": { "type": "boolean", "default": true }, "models": { "type": "array", "items": { "$ref": "#/$defs/ModelPattern" } }, "deny_models": { "type": "array", "items": { "$ref": "#/$defs/ModelPattern" } }, "providers": { "type": "array", "items": { "$ref": "#/$defs/NamePattern" } }, "deny_providers": { "type": "array", "items": { "$ref": "#/$defs/NamePattern" } }, "deployments": { "type": "array", "items": { "$ref": "#/$defs/NamePattern" } }, "endpoints": { "type": "array", "items": { "$ref": "#/$defs/EndpointFamily" } }, "allowed_ips": { "type": "array", "items": { "anyOf": [ { "$ref": "#/$defs/Cidr" }, { "$ref": "#/$defs/IpSetRef" } ] } }, "tags": { "type": "array", "items": { "$ref": "#/$defs/Tag" } }, "metadata": { "$ref": "#/$defs/Metadata" }, "policies": { "$ref": "#/$defs/PoliciesTenant" }, "max_key_lifetime": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } }, "regions": { "type": "array", "items": { "$ref": "#/$defs/Region" } }, "deny_regions": { "type": "array", "items": { "$ref": "#/$defs/Region" } }, "key_policy": { "$ref": "#/$defs/KeyPolicy" } }, "required": [ "team" ], "additionalProperties": false }, "Key": { "type": "object", "description": "A virtual key.", "properties": { "project": { "$ref": "#/$defs/TenantName", "default": "default" }, "kind": { "enum": [ "secret", "jwt" ], "default": "secret" }, "secret": { "$ref": "#/$defs/Secret", "description": "Config-declared keys only; not with kind jwt." }, "enabled": { "type": "boolean", "default": true }, "models": { "type": "array", "items": { "$ref": "#/$defs/ModelPattern" } }, "deny_models": { "type": "array", "items": { "$ref": "#/$defs/ModelPattern" } }, "providers": { "type": "array", "items": { "$ref": "#/$defs/NamePattern" } }, "deny_providers": { "type": "array", "items": { "$ref": "#/$defs/NamePattern" } }, "deployments": { "type": "array", "items": { "$ref": "#/$defs/NamePattern" } }, "endpoints": { "type": "array", "items": { "$ref": "#/$defs/EndpointFamily" } }, "allowed_ips": { "type": "array", "items": { "anyOf": [ { "$ref": "#/$defs/Cidr" }, { "$ref": "#/$defs/IpSetRef" } ] } }, "require_client_cert": { "description": "The key authenticates only on a request whose verified client certificate matches; exactly one of the two members.", "anyOf": [ { "type": "object", "properties": { "sha256_fingerprint": { "type": "string", "pattern": "^([0-9A-Fa-f]{64}|([0-9A-Fa-f]{2}:){31}[0-9A-Fa-f]{2})$" }, "san": { "type": "string", "minLength": 1, "maxLength": 1024 } }, "minProperties": 1, "maxProperties": 1, "additionalProperties": false }, { "type": "null" } ] }, "tags": { "type": "array", "items": { "$ref": "#/$defs/Tag" } }, "metadata": { "$ref": "#/$defs/Metadata" }, "policies": { "$ref": "#/$defs/PoliciesTenant" }, "expires_at": { "$ref": "#/$defs/RfcTime" }, "owner": { "$ref": "#/$defs/UserName" }, "description": { "type": "string", "maxLength": 500 }, "permissions": { "type": "array", "description": "catalogue.", "items": { "enum": [ "override:relax", "models:direct_provider", "route:pin", "route:debug", "route:decide", "route:fallbacks", "byok", "tags:request", "debug", "limits:read_inherited" ] }, "uniqueItems": true, "default": [] }, "allowed_request_tags": { "type": "array", "items": { "$ref": "#/$defs/TagPattern" }, "default": [ "*" ] }, "end_user": { "enum": [ "optional", "required" ], "default": "optional" }, "priority_class": { "$ref": "#/$defs/PriorityClass", "description": "The class this key's requests count in for limits with `priority_shares`. Absent: no class (the remainder)." }, "regions": { "type": "array", "items": { "$ref": "#/$defs/Region" } }, "deny_regions": { "type": "array", "items": { "$ref": "#/$defs/Region" } } }, "additionalProperties": false, "allOf": [ { "if": { "properties": { "kind": { "const": "jwt" } }, "required": [ "kind" ] }, "then": { "properties": { "secret": false } } } ] }, "User": { "type": "object", "properties": { "kind": { "enum": [ "human", "service" ], "default": "human" }, "email": { "type": "string", "pattern": "^[^@\\s]+@[^@\\s]+$" }, "enabled": { "type": "boolean", "default": true }, "role_bindings": { "type": "array", "items": { "type": "object", "properties": { "role": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" }, "scope": { "type": "string", "pattern": "^(gateway|organization/[a-z0-9][a-z0-9_-]{0,62}|team/[a-z0-9][a-z0-9_-]{0,62}|project/[a-z0-9][a-z0-9_-]{0,62})$" } }, "required": [ "role", "scope" ], "additionalProperties": false } }, "display_name": { "type": "string", "minLength": 1, "maxLength": 200 }, "title": { "type": "string", "minLength": 1, "maxLength": 100 }, "primary_team": { "$ref": "#/$defs/TenantName" } }, "additionalProperties": false, "allOf": [ { "if": { "not": { "properties": { "kind": { "const": "service" } }, "required": [ "kind" ] } }, "then": { "required": [ "email" ] } } ] }, "Auth": { "type": "object", "description": "Top-level `auth`.", "properties": { "mode": { "enum": [ "required", "disabled" ], "default": "required" }, "key_pepper": { "$ref": "#/$defs/Secret", "description": "≥ 32 bytes; required in cluster mode." }, "revocation_max_delay": { "$ref": "#/$defs/Duration", "x-range": { "min": "1s", "max": "60s" }, "default": "2s" }, "negative_cache_ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s", "max": "5s" }, "default": "1s" }, "store_outage_grace": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s", "max": "24h" }, "default": "10m" }, "forwarded_client_cert": { "type": "boolean", "default": false, "description": "A request from a peer in security.client_ip.trusted_proxies may carry the client certificate its proxy verified in Client-Cert (RFC 9440)." }, "model_groups": { "type": "object", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "array", "items": { "allOf": [ { "$ref": "#/$defs/ModelPattern" }, { "not": { "pattern": "^group:" } } ] }, "description": "Model patterns; `group:` is not allowed here (no nesting)." } }, "failed_auth_throttle": { "$ref": "#/$defs/AuthThrottle", "default": { "max_failures": 50, "window": "1m" } }, "jwt": { "type": "object", "description": "JWT providers.", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "object", "properties": { "issuer": { "type": "string", "minLength": 1 }, "audiences": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 }, "jwks_uri": { "$ref": "#/$defs/Url" }, "jwks": { "anyOf": [ { "type": "object", "description": "Inline JWKS." }, { "type": "null" } ], "default": null }, "hmac_secret": { "anyOf": [ { "$ref": "#/$defs/Secret" }, { "type": "null" } ], "default": null }, "algorithms": { "type": "array", "items": { "enum": [ "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "EdDSA", "HS256", "HS384", "HS512" ] }, "minItems": 1, "uniqueItems": true, "default": [ "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "EdDSA" ] }, "clock_skew": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s", "max": "5m" }, "default": "60s" }, "max_token_lifetime": { "anyOf": [ { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } }, { "type": "null" } ], "default": null }, "jwks_refresh_interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "30s", "max": "24h" }, "default": "5m" }, "jwks_max_stale": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s", "max": "7d" }, "default": "24h" }, "end_user_claim": { "type": "string", "minLength": 1 }, "mappings": { "type": "array", "items": { "type": "object", "properties": { "match": { "type": "object", "properties": { "claims": { "type": "object", "additionalProperties": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] } } }, "additionalProperties": false }, "key": { "$ref": "#/$defs/Name" } }, "required": [ "match", "key" ], "additionalProperties": false }, "minItems": 1 }, "allow_insecure_jwks": { "type": "boolean", "default": false, "description": "Fetch `jwks_uri` over plain http or an unverified TLS profile outside test mode." } }, "required": [ "issuer", "audiences", "mappings" ], "additionalProperties": false, "allOf": [ { "not": { "required": [ "jwks_uri", "jwks" ], "properties": { "jwks": { "type": "object" } } }, "description": "jwks_uri or jwks, not both." }, { "anyOf": [ { "required": [ "jwks_uri" ] }, { "required": [ "jwks" ], "properties": { "jwks": { "type": "object" } } }, { "required": [ "hmac_secret" ], "properties": { "hmac_secret": { "type": "string" } } } ], "description": "Some key material: jwks_uri, jwks or hmac_secret." } ] } }, "access_rules": { "type": "array", "items": { "type": "object", "properties": { "models": { "type": "array", "items": { "$ref": "#/$defs/ModelPattern" }, "minItems": 1 }, "require": { "type": "object", "properties": { "claims": { "type": "object", "additionalProperties": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] } }, "key_tags": { "type": "array", "items": { "$ref": "#/$defs/Tag" } }, "headers": { "type": "object", "propertyNames": { "$ref": "#/$defs/HeaderName" }, "additionalProperties": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] } } }, "additionalProperties": false } }, "required": [ "models", "require" ], "additionalProperties": false }, "default": [] }, "external_authz": { "anyOf": [ { "type": "object", "properties": { "url": { "$ref": "#/$defs/HttpsUrl" }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "200ms" }, "send_headers": { "type": "array", "items": { "$ref": "#/$defs/HeaderName" } }, "fail_mode": { "enum": [ "closed", "open" ], "default": "closed" }, "allow_ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" } }, "deny_ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" } } }, "required": [ "url" ], "additionalProperties": false }, { "type": "null" } ], "default": null }, "admin": { "type": "object", "properties": { "bootstrap_token": { "$ref": "#/$defs/Secret" }, "public_origin": { "$ref": "#/$defs/Url" }, "session": { "type": "object", "properties": { "idle_timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "5m", "max": "24h" }, "default": "1h" }, "absolute_timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "15m", "max": "7d" }, "default": "12h" }, "trusted_device": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": false }, "max_age": { "$ref": "#/$defs/Duration", "x-range": { "min": "1d", "max": "30d" }, "default": "30d" }, "idle_timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "1h", "max": "30d" }, "default": "7d" } }, "additionalProperties": false } }, "additionalProperties": false }, "login_throttle": { "$ref": "#/$defs/AuthThrottle", "default": { "max_failures": 10, "window": "1m" } }, "sso": { "type": "object", "properties": { "oidc": { "type": "object", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "object", "properties": { "issuer": { "$ref": "#/$defs/Url" }, "client_id": { "type": "string", "minLength": 1 }, "client_secret": { "$ref": "#/$defs/Secret" }, "scopes": { "type": "array", "items": { "type": "string", "minLength": 1 }, "default": [ "openid", "email", "profile", "groups" ] }, "allowed_email_domains": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "jit_provisioning": { "type": "boolean", "default": true }, "role_mappings": { "type": "array", "items": { "type": "object", "properties": { "claim": { "type": "string", "minLength": 1 }, "value": { "type": "string" }, "role": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" }, "scope": { "type": "string", "pattern": "^(gateway|organization/[a-z0-9][a-z0-9_-]{0,62}|team/[a-z0-9][a-z0-9_-]{0,62}|project/[a-z0-9][a-z0-9_-]{0,62})$" } }, "required": [ "claim", "value", "role", "scope" ], "additionalProperties": false } }, "display_name": { "type": "string", "minLength": 1, "maxLength": 64 }, "default_role_bindings": { "type": "array", "items": { "type": "object", "properties": { "role": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" }, "scope": { "type": "string", "pattern": "^(gateway|organization/[a-z0-9][a-z0-9_-]{0,62}|team/[a-z0-9][a-z0-9_-]{0,62}|project/[a-z0-9][a-z0-9_-]{0,62})$" } }, "required": [ "role", "scope" ], "additionalProperties": false }, "default": [] }, "allow_insecure_discovery": { "type": "boolean", "default": false, "description": "Fetch discovery, the JWKS and the token endpoint over plain http or an unverified TLS profile outside test mode." } }, "required": [ "issuer", "client_id" ], "additionalProperties": false } }, "saml": { "type": "object", "description": "SAML 2.0 identity providers.", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "object", "properties": { "display_name": { "type": "string", "minLength": 1, "maxLength": 64 }, "idp": { "type": "object", "description": "Exactly one source of the identity provider: metadata_url, metadata, or entity_id with sso_url and certificates.", "properties": { "metadata_url": { "$ref": "#/$defs/Url", "description": "The identity provider's metadata, fetched as operator egress and kept in the store." }, "metadata": { "type": "string", "minLength": 1, "maxLength": 4194304, "description": "The identity provider's metadata document, inline." }, "entity_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "sso_url": { "$ref": "#/$defs/Url", "description": "The HTTP-Redirect SingleSignOnService location." }, "certificates": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1, "maxItems": 10, "description": "PEM signing certificates; an assertion signed by any of them is trusted." }, "allow_insecure_metadata": { "type": "boolean", "default": false, "description": "With metadata_url: fetch the metadata over plain http, or with an egress TLS profile that does not verify servers, outside test mode." }, "metadata_refresh": { "$ref": "#/$defs/Duration", "x-range": { "min": "5m", "max": "30d" }, "default": "24h" } }, "additionalProperties": false }, "sp_entity_id": { "anyOf": [ { "type": "string", "minLength": 1, "maxLength": 1024 }, { "type": "null" } ], "default": null, "description": "Null = /admin/v1/auth/saml//metadata, the origin being auth.admin.public_origin or the request's own." }, "name_id_format": { "enum": [ "email", "persistent", "transient", "unspecified" ], "default": "email" }, "email_attribute": { "anyOf": [ { "type": "string", "minLength": 1, "maxLength": 1024 }, { "type": "null" } ], "default": null, "description": "The attribute holding the user's email address; null = the NameID." }, "allowed_email_domains": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "jit_provisioning": { "type": "boolean", "default": true }, "role_mappings": { "type": "array", "items": { "type": "object", "properties": { "attribute": { "type": "string", "minLength": 1, "maxLength": 1024, "description": "A SAML attribute's Name, as the assertion carries it." }, "value": { "type": "string" }, "role": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" }, "scope": { "type": "string", "pattern": "^(gateway|organization/[a-z0-9][a-z0-9_-]{0,62}|team/[a-z0-9][a-z0-9_-]{0,62}|project/[a-z0-9][a-z0-9_-]{0,62})$" } }, "required": [ "attribute", "value", "role", "scope" ], "additionalProperties": false }, "default": [] }, "default_role_bindings": { "type": "array", "items": { "type": "object", "properties": { "role": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" }, "scope": { "type": "string", "pattern": "^(gateway|organization/[a-z0-9][a-z0-9_-]{0,62}|team/[a-z0-9][a-z0-9_-]{0,62}|project/[a-z0-9][a-z0-9_-]{0,62})$" } }, "required": [ "role", "scope" ], "additionalProperties": false }, "default": [] }, "allow_idp_initiated": { "type": "boolean", "default": false, "description": "Accept responses the identity provider sends without a request." }, "clock_skew": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s", "max": "5m" }, "default": "60s" } }, "required": [ "idp" ], "additionalProperties": false }, "default": {} }, "oauth": { "type": "object", "description": "OAuth 2.0 sign-in without an ID token.", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "object", "properties": { "type": { "enum": [ "github" ] }, "client_id": { "type": "string", "minLength": 1, "maxLength": 256 }, "client_secret": { "$ref": "#/$defs/Secret" }, "display_name": { "type": "string", "minLength": 1, "maxLength": 64 }, "api_base_url": { "$ref": "#/$defs/Url", "default": "https://api.github.com" }, "allowed_organizations": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 100 }, "default": [] }, "jit_provisioning": { "type": "boolean", "default": true }, "role_mappings": { "type": "array", "items": { "type": "object", "properties": { "organization": { "type": "string", "minLength": 1, "maxLength": 100 }, "team": { "type": "string", "minLength": 1, "maxLength": 100 }, "role": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" }, "scope": { "type": "string", "pattern": "^(gateway|organization/[a-z0-9][a-z0-9_-]{0,62}|team/[a-z0-9][a-z0-9_-]{0,62}|project/[a-z0-9][a-z0-9_-]{0,62})$" } }, "required": [ "organization", "role", "scope" ], "additionalProperties": false }, "default": [] } }, "required": [ "type", "client_id", "client_secret" ], "additionalProperties": false }, "default": {} } }, "additionalProperties": false }, "scim": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": false }, "token": { "$ref": "#/$defs/Secret" }, "group_mappings": { "type": "array", "items": { "type": "object", "properties": { "group": { "type": "string", "minLength": 1 }, "role": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" }, "scope": { "type": "string", "pattern": "^(gateway|organization/[a-z0-9][a-z0-9_-]{0,62}|team/[a-z0-9][a-z0-9_-]{0,62}|project/[a-z0-9][a-z0-9_-]{0,62})$" } }, "required": [ "group", "role", "scope" ], "additionalProperties": false }, "default": [] } }, "additionalProperties": false }, "roles": { "type": "object", "description": "Custom roles: a name that is not a built-in role; bindable_at defaults to organization, team and project.", "propertyNames": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" }, "additionalProperties": { "type": "object", "properties": { "permissions": { "type": "array", "items": { "type": "string", "pattern": "^[a-z_]+:[a-z_]+$" }, "minItems": 1, "uniqueItems": true }, "bindable_at": { "type": "array", "items": { "enum": [ "gateway", "organization", "team", "project" ] }, "minItems": 1, "uniqueItems": true }, "description": { "type": "string", "maxLength": 500 } }, "required": [ "permissions" ], "additionalProperties": false }, "default": {} }, "local": { "type": "object", "description": "Local accounts: people sign in to the console with an email and a password (and a second factor), and accept invitations by choosing one. On by default.", "properties": { "enabled": { "type": "boolean", "default": true }, "password_policy": { "type": "object", "properties": { "min_length": { "type": "integer", "minimum": 8, "maximum": 128, "default": 12 }, "max_length": { "type": "integer", "minimum": 8, "maximum": 1024, "default": 128 }, "deny_common": { "type": "boolean", "default": true }, "history": { "type": "integer", "minimum": 0, "maximum": 24, "default": 5 }, "max_age": { "$ref": "#/$defs/DurationOrNone", "default": "none" } }, "additionalProperties": false }, "mfa": { "type": "object", "properties": { "factors": { "type": "array", "items": { "enum": [ "totp", "webauthn" ] }, "minItems": 1, "uniqueItems": true, "default": [ "totp", "webauthn" ] }, "webauthn": { "type": "object", "properties": { "rp_id": { "type": "string", "minLength": 1, "maxLength": 253 }, "rp_name": { "type": "string", "minLength": 1, "maxLength": 64, "default": "Antirion" } }, "additionalProperties": false }, "recovery_codes": { "type": "integer", "minimum": 5, "maximum": 20, "default": 10 } }, "additionalProperties": false }, "sso_required_domains": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 253 }, "default": [] }, "lockout": { "type": "object", "properties": { "max_failures": { "type": "integer", "minimum": 1, "maximum": 1000, "default": 10 }, "window": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "15m" }, "duration": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s", "max": "24h" }, "default": "15m" } }, "additionalProperties": false }, "reset_token_ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "5m", "max": "24h" }, "default": "30m" } }, "additionalProperties": false }, "invitations": { "type": "object", "properties": { "ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "1h", "max": "30d" }, "default": "7d" } }, "additionalProperties": false }, "login_page": { "type": "object", "properties": { "show_version": { "type": "boolean", "default": false }, "ticker": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": false } }, "additionalProperties": false } }, "additionalProperties": false }, "playground": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": true }, "key_ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "1m", "max": "1h" }, "default": "15m" }, "max_requests_per_key": { "type": "integer", "minimum": 1, "maximum": 10000, "default": 100 } }, "additionalProperties": false }, "personal_tokens": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": true }, "max_lifetime": { "$ref": "#/$defs/Duration", "x-range": { "min": "1h", "max": "365d" }, "default": "90d" } }, "additionalProperties": false }, "device_authorization": { "type": "object", "description": "The CLI sign-in through the device authorization grant.", "properties": { "enabled": { "type": "boolean", "default": false }, "code_ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "1m", "max": "1h" }, "default": "10m", "description": "How long a device code and its user code stay valid." }, "poll_interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "1s", "max": "60s" }, "default": "5s", "description": "The least time between two polls of one device code." }, "token_ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "5m", "max": "7d" }, "default": "12h", "description": "The lifetime of the admin token a sign-in issues." }, "max_starts_per_minute": { "type": "integer", "minimum": 1, "maximum": 1000, "default": 10, "description": "Device authorizations one client address may start per minute." } }, "additionalProperties": false }, "max_active_users": { "anyOf": [ { "type": "integer", "minimum": 1 }, { "type": "null" } ], "default": null } }, "additionalProperties": false }, "ip_sets": { "type": "object", "description": "Named IP sets referenced as `set:` in allowed_ips.", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "array", "items": { "$ref": "#/$defs/Cidr" }, "minItems": 1, "maxItems": 1024 }, "default": {} }, "anomaly_detection": { "type": "object", "description": "Key anomaly flags.", "properties": { "enabled": { "type": "boolean", "default": true }, "baseline": { "$ref": "#/$defs/Duration", "x-range": { "min": "1d", "max": "30d" }, "default": "7d" }, "spike_factor": { "type": "number", "minimum": 1.5, "maximum": 1000, "default": 5 }, "min_requests": { "type": "integer", "minimum": 1, "default": 100 }, "new_network": { "type": "boolean", "default": true }, "new_user_agent": { "type": "boolean", "default": true }, "new_country": { "type": "boolean", "default": true } }, "additionalProperties": false } }, "additionalProperties": false }, "LimitsSettings": { "type": "object", "description": "Top-level `limits`: settings only; declarations live in policies.limits.", "properties": { "enabled": { "type": "boolean", "default": true }, "algorithm": { "enum": [ "gcra", "sliding_window" ], "default": "gcra" }, "estimation": { "type": "object", "properties": { "input": { "enum": [ "auto", "bytes", "upper_bound" ], "default": "auto" }, "bytes_per_token": { "$ref": "#/$defs/Decimal", "description": "Decimal > 0.", "not": { "pattern": "^0+(\\.0+)?$" }, "default": "3.0" }, "image_tokens_default": { "type": "integer", "minimum": 0, "default": 1600 }, "audio_tokens_default": { "type": "integer", "minimum": 0, "default": 1500 }, "video_tokens_default": { "type": "integer", "minimum": 0, "default": 10000 }, "output": { "enum": [ "strict", "clamp", "optimistic" ], "default": "strict" }, "default_max_output_tokens": { "type": "integer", "minimum": 1, "default": 4096 }, "output_cap": { "anyOf": [ { "type": "integer", "minimum": 1 }, { "type": "null" } ], "default": null }, "max_output_tokens_ceiling": { "type": "integer", "minimum": 1, "default": 1073741823 } }, "additionalProperties": false, "allOf": [ { "if": { "properties": { "output": { "enum": [ "clamp", "optimistic" ] } }, "required": [ "output" ] }, "then": { "required": [ "output_cap" ], "properties": { "output_cap": { "type": "integer" } } } } ] }, "lease_ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "5s" }, "default": "60s" }, "store": { "type": "object", "properties": { "timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "100ms" } }, "additionalProperties": false }, "on_store_unavailable": { "enum": [ "local_share", "fail_closed", "fail_open" ], "default": "local_share" }, "headers": { "type": "object", "properties": { "ietf": { "type": "boolean", "default": true }, "dialect": { "type": "boolean", "default": true }, "max_policies": { "type": "integer", "minimum": 1, "maximum": 32, "default": 10 }, "expose_reservation": { "type": "boolean", "default": false } }, "additionalProperties": false }, "forward_upstream_headers": { "type": "boolean", "default": false } }, "additionalProperties": false }, "BudgetsSettings": { "type": "object", "description": "Top-level `budgets`: settings only.", "properties": { "expose_headers": { "type": "boolean", "default": false }, "charge_auxiliary": { "type": "boolean", "default": false }, "on_store_unavailable": { "enum": [ "fail_closed", "local_share" ], "default": "fail_closed" }, "alerts": { "type": "object", "properties": { "sink": { "$ref": "#/$defs/Name", "description": "An alert webhook in observability.alerts.webhooks." } }, "additionalProperties": false } }, "additionalProperties": false }, "Pricing": { "type": "object", "description": "Top-level `pricing`.", "properties": { "catalog": { "enum": [ "bundled", "none" ], "default": "bundled" }, "on_unpriced": { "enum": [ "reject_if_budgeted", "zero" ], "default": "reject_if_budgeted" }, "report_in_body": { "type": "boolean", "default": false }, "multipliers": { "type": "object", "properties": { "organizations": { "type": "object", "propertyNames": { "$ref": "#/$defs/TenantName" }, "additionalProperties": { "$ref": "#/$defs/Decimal" } }, "teams": { "type": "object", "propertyNames": { "$ref": "#/$defs/TenantName" }, "additionalProperties": { "$ref": "#/$defs/Decimal" } }, "projects": { "type": "object", "propertyNames": { "$ref": "#/$defs/TenantName" }, "additionalProperties": { "$ref": "#/$defs/Decimal" } }, "keys": { "type": "object", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "$ref": "#/$defs/Decimal" } } }, "additionalProperties": false }, "tools": { "type": "object", "description": "\"/\" or \"/*\" → price.", "propertyNames": { "type": "string", "pattern": "^[a-z0-9]([a-z0-9-]{0,30}[a-z0-9])?/.+$" }, "additionalProperties": { "$ref": "#/$defs/CallPrice" } }, "agents": { "type": "object", "description": "A2A agent → price.", "propertyNames": { "$ref": "#/$defs/McpName" }, "additionalProperties": { "$ref": "#/$defs/CallPrice" } }, "models": { "type": "object", "description": "\"/\" or \"\" → price.", "propertyNames": { "type": "string", "minLength": 1 }, "additionalProperties": { "$ref": "#/$defs/Price" } } }, "additionalProperties": false }, "PolicyLimits": { "type": "object", "description": "`policies.limits`: map name → limit declaration, plus 's `locked` / `request_overridable`, which are reserved names.", "properties": { "locked": { "$ref": "#/$defs/FieldPaths" }, "request_overridable": { "$ref": "#/$defs/FieldPaths" } }, "additionalProperties": { "$ref": "#/$defs/Limit" }, "propertyNames": { "pattern": "^[a-z0-9_]{1,64}$" } }, "PolicyBudgets": { "type": "object", "description": "`policies.budgets`: map name → budget declaration, plus 's `locked` / `request_overridable`, which are reserved names.", "properties": { "locked": { "$ref": "#/$defs/FieldPaths" }, "request_overridable": { "$ref": "#/$defs/FieldPaths" } }, "additionalProperties": { "$ref": "#/$defs/Budget" }, "propertyNames": { "pattern": "^[a-z0-9_]{1,64}$" } }, "Cache": { "type": "object", "description": "Top-level `cache`: storage settings only.", "properties": { "backend": { "type": "object", "properties": { "type": { "enum": [ "memory", "redis" ] }, "memory": { "type": "object", "properties": { "max_size": { "$ref": "#/$defs/Size", "x-range": { "gt": "0B" }, "default": "256MiB" } }, "additionalProperties": false }, "redis": { "type": "object", "properties": { "url": { "$ref": "#/$defs/Secret" }, "key_prefix": { "type": "string", "minLength": 1, "maxLength": 64, "default": "antirion:cache:" } }, "additionalProperties": false }, "lookup_timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "1ms", "max": "5s" }, "default": "50ms" }, "write_timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "1ms", "max": "30s" }, "default": "1s" } }, "additionalProperties": false }, "semantic_store": { "type": "object", "properties": { "type": { "enum": [ "memory", "redis", "pgvector" ], "default": "memory" }, "memory": { "type": "object", "properties": { "max_entries": { "type": "integer", "minimum": 1, "maximum": 10000000, "default": 100000 } }, "additionalProperties": false }, "redis": { "type": "object", "properties": { "url": { "$ref": "#/$defs/Secret" } }, "additionalProperties": false }, "pgvector": { "type": "object", "properties": { "dsn": { "$ref": "#/$defs/Secret" } }, "additionalProperties": false }, "lookup_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "100ms" } }, "additionalProperties": false }, "invalidation_rules": { "type": "object", "description": "Invalidation rules.", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": true }, "description": { "type": "string", "maxLength": 500 }, "trigger": { "type": "object", "properties": { "event": { "enum": [ "model_disabled", "deployment_changed", "route_changed", "schedule", "metadata_changed", "manual" ] }, "schedule": { "type": "string", "minLength": 1, "maxLength": 100, "description": "Five-field cron expression in UTC (schedule triggers)." }, "metadata_key": { "type": "string", "minLength": 1, "maxLength": 64 } }, "required": [ "event" ], "additionalProperties": false }, "action": { "type": "object", "properties": { "drop": { "enum": [ "model", "route", "deployment", "key", "end_user", "tag", "metadata", "older_than" ] }, "value": { "type": "string", "minLength": 1, "maxLength": 512 }, "older_than": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } } }, "required": [ "drop" ], "additionalProperties": false } }, "required": [ "trigger", "action" ], "additionalProperties": false }, "default": {} } }, "additionalProperties": false }, "PolicyCache": { "type": "object", "description": "`policies.cache` member.", "properties": { "enabled": { "type": "boolean", "description": "; refused under zero data retention.", "default": false }, "activation": { "enum": [ "always", "opt_in" ], "default": "always" }, "scope": { "enum": [ "organization", "team", "project", "key", "end_user", "shared" ], "default": "project" }, "shared_namespace": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "null" } ], "default": null }, "ttl": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "1h" }, "max_ttl": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "description": "≥ ttl.", "default": "7d" }, "endpoints": { "type": "array", "description": "Subset of; the native generate endpoints use 's ids.", "items": { "enum": [ "openai.chat_completions", "openai.completions", "openai.responses", "anthropic.messages", "openai.embeddings", "rerank", "gemini_generate", "bedrock_converse", "bedrock_invoke" ] }, "uniqueItems": true, "default": [ "openai.chat_completions", "openai.completions", "openai.responses", "anthropic.messages", "openai.embeddings", "rerank" ] }, "max_entry_size": { "$ref": "#/$defs/Size", "x-range": { "min": "1KiB", "max": "64MiB" }, "default": "1MiB" }, "store_after_fallback": { "type": "boolean", "default": false }, "hit_usage": { "enum": [ "original", "zero" ], "default": "original" }, "max_messages": { "anyOf": [ { "type": "integer", "minimum": 1 }, { "type": "null" } ], "default": null }, "key": { "type": "object", "properties": { "include_headers": { "type": "array", "items": { "$ref": "#/$defs/LowerHeaderName" }, "default": [ "anthropic-version", "anthropic-beta", "openai-beta" ] }, "ignore_fields": { "type": "array", "description": "JSON Pointer patterns (`*` as a whole token); not under /model.", "items": { "type": "string", "pattern": "^(/([^~/]|~[01])*)+$", "not": { "pattern": "^/model(/|$)" } }, "default": [] } }, "additionalProperties": false }, "request_overridable": { "type": "array", "description": "Directive names.", "items": { "enum": [ "no_cache", "no_store", "bypass", "max_age", "ttl", "namespace", "threshold", "use" ] }, "uniqueItems": true, "default": [ "no_cache", "no_store", "bypass", "max_age", "ttl", "namespace", "threshold", "use" ] }, "locked": { "$ref": "#/$defs/FieldPaths", "default": [] }, "fail_mode": { "enum": [ "open", "closed" ], "default": "open", "description": "For closed." }, "semantic": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": false }, "embedding_model": { "anyOf": [ { "$ref": "#/$defs/ModelName" }, { "type": "null" } ], "default": null }, "threshold": { "$ref": "#/$defs/Ratio", "default": 0.95 }, "max_text_chars": { "type": "integer", "minimum": 1, "maximum": 100000, "default": 8192 }, "polarity_guard": { "type": "boolean", "default": true }, "polarity_lexicon": { "anyOf": [ { "const": "default" }, { "type": "array", "items": { "type": "string", "minLength": 1 } } ], "default": "default" } }, "additionalProperties": false, "allOf": [ { "if": { "properties": { "enabled": { "const": true } }, "required": [ "enabled" ] }, "then": { "required": [ "embedding_model" ], "properties": { "embedding_model": { "type": "string" } } } } ] }, "coalesce": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": false }, "max_wait": { "$ref": "#/$defs/Duration", "x-range": { "min": "1ms", "max": "5m" }, "default": "30s" } }, "additionalProperties": false }, "prompt_caching": { "type": "object", "properties": { "auto_inject": { "type": "boolean", "default": false }, "targets": { "type": "array", "items": { "enum": [ "system", "tools", "messages" ] }, "minItems": 1, "uniqueItems": true, "default": [ "system", "tools", "messages" ] }, "min_prefix_tokens": { "type": "integer", "minimum": 0, "maximum": 1000000, "default": 1024 }, "message_offset": { "type": "integer", "minimum": 0, "default": 0 }, "ttl": { "enum": [ "5m", "1h" ], "default": "5m" }, "openai_cache_key": { "type": "boolean", "default": false } }, "additionalProperties": false }, "read_only": { "type": "boolean", "default": false }, "max_entries": { "anyOf": [ { "type": "integer", "minimum": 1 }, { "type": "null" } ], "default": null }, "embeddings": { "type": "object", "properties": { "per_item": { "type": "boolean", "description": "Each element of an `openai.embeddings` request's `input` array is cached on its own; only the elements that miss go upstream.", "default": false } }, "additionalProperties": false } }, "additionalProperties": false, "allOf": [ { "if": { "properties": { "scope": { "const": "shared" } }, "required": [ "scope" ] }, "then": { "required": [ "shared_namespace" ], "properties": { "shared_namespace": { "type": "string" } } }, "else": { "properties": { "shared_namespace": { "type": "null" } } } } ] }, "Guardrail": { "type": "object", "description": "A guardrail definition.", "properties": { "type": { "enum": [ "regex", "keywords", "pii", "secrets", "moderation", "webhook", "system_prompt", "decorator", "llm_judge", "json_schema", "tool_permission", "length", "classifier", "bedrock_guardrails", "azure_content_safety", "model_armor", "lakera", "template", "llm_rewrite", "json_repair", "topic" ], "description": "; unknown types are rejected." }, "enabled": { "type": "boolean", "default": true }, "action": { "enum": [ "block", "redact", "flag", "divert" ] }, "execution": { "enum": [ "blocking", "async", "parallel_with_call" ], "default": "blocking" }, "on_error": { "enum": [ "block", "allow" ] }, "order": { "type": "integer", "default": 0 }, "message": { "anyOf": [ { "type": "string", "maxLength": 500 }, { "type": "null" } ] }, "include_operator_content": { "type": "boolean", "default": false }, "scope": { "type": "object", "description": "Input stage only.", "properties": { "kinds": { "type": "array", "items": { "enum": [ "system", "user", "assistant", "tool", "tool_definition" ] }, "uniqueItems": true, "default": [ "system", "user", "assistant", "tool", "tool_definition" ] }, "messages": { "enum": [ "all", "last_user" ], "default": "all" } }, "additionalProperties": false }, "replacement": { "enum": [ "label", "mask", "hash" ], "default": "label" }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "10ms", "max": "60s" }, "default": "2s" }, "max_concurrency": { "type": "integer", "minimum": 1 }, "categories": { "type": "object", "description": "Label → category.", "additionalProperties": { "enum": [ "deny_pattern", "allow_pattern", "keyword", "pii", "secret", "hate", "harassment", "violence", "sexual", "self_harm", "illicit", "prompt_injection", "off_topic", "invalid_json", "schema_violation", "tool_not_allowed", "length", "uninspectable", "custom" ] } }, "request_stages": { "type": "array", "items": { "enum": [ "input", "output" ] }, "uniqueItems": true }, "divert_to": { "$ref": "#/$defs/ModelName", "description": "The Model whose route serves a request with a finding; required with action divert and only with it." }, "regex": { "type": "object", "properties": { "deny": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 1000 }, "maxItems": 256 }, "allow": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 1000 }, "maxItems": 256 }, "label": { "type": "string", "minLength": 1, "description": "The label a replacement names ([LABEL]); a reversible rule without one uses its name in upper case.", "default": "REDACTED" }, "validate": { "$ref": "#/$defs/PatternCheck" }, "reversible": { "type": "boolean", "description": "Input matches become numbered tokens ([LABEL_1]) that the output stage puts back; needs action redact, replacement label and no allow patterns.", "default": false } }, "additionalProperties": false }, "keywords": { "type": "object", "properties": { "words": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 256 }, "minItems": 1, "maxItems": 100000 }, "match": { "enum": [ "word", "substring" ], "default": "word" } }, "required": [ "words" ], "additionalProperties": false }, "pii": { "type": "object", "properties": { "entities": { "type": "array", "items": { "enum": [ "email", "phone", "credit_card", "us_ssn", "iban", "ip_address", "ca_sin" ] }, "uniqueItems": true, "description": "The built-in entities; empty when only custom entities apply.", "default": [ "email", "phone", "credit_card", "us_ssn", "iban", "ip_address", "ca_sin" ] }, "custom": { "type": "array", "description": "The rule's own kinds of personal data, found beside the built-in entities.", "items": { "$ref": "#/$defs/PiiCustomEntity" }, "maxItems": 64, "default": [] }, "preserve": { "type": "array", "items": { "enum": [ "email_domain", "ip_subnet", "last4", "country" ] }, "uniqueItems": true, "default": [] }, "reversible": { "type": "boolean", "description": "Input values become numbered tokens ([EMAIL_1], [CPF_1]) that the response gets back wherever the model repeats them; needs action redact, replacement label and no preserve.", "default": false } }, "additionalProperties": false }, "secrets": { "type": "object", "properties": { "detectors": { "type": "array", "items": { "enum": [ "openai_key", "anthropic_key", "aws_access_key", "github_token", "slack_token", "google_api_key", "stripe_key", "jwt", "pem_private_key" ] }, "minItems": 1, "uniqueItems": true, "default": [ "openai_key", "anthropic_key", "aws_access_key", "github_token", "slack_token", "google_api_key", "stripe_key", "jwt", "pem_private_key" ] }, "min_entropy": { "anyOf": [ { "type": "number", "minimum": 0, "maximum": 8 }, { "type": "null" } ], "default": null } }, "additionalProperties": false }, "moderation": { "type": "object", "properties": { "model": { "$ref": "#/$defs/ModelName" }, "thresholds": { "type": "object", "additionalProperties": { "$ref": "#/$defs/Ratio" } }, "max_inputs_per_call": { "type": "integer", "minimum": 1, "maximum": 1024, "default": 32 }, "max_chars": { "type": "integer", "minimum": 100, "maximum": 1000000, "default": 8000 }, "overlap_chars": { "type": "integer", "minimum": 0, "default": 200 } }, "required": [ "model" ], "additionalProperties": false }, "webhook": { "type": "object", "properties": { "url": { "$ref": "#/$defs/HttpsUrl" }, "headers": { "$ref": "#/$defs/HeaderValues" }, "mode": { "enum": [ "segments", "body" ], "default": "segments" }, "signing_secret": { "anyOf": [ { "$ref": "#/$defs/Secret" }, { "type": "null" } ] } }, "required": [ "url" ], "additionalProperties": false }, "system_prompt": { "type": "object", "properties": { "text": { "type": "string" }, "mode": { "enum": [ "replace", "prepend", "append", "insert_if_absent" ] }, "role": { "enum": [ "system", "developer" ], "default": "system" } }, "required": [ "text" ], "additionalProperties": false }, "decorator": { "type": "object", "properties": { "prepend": { "type": "array", "items": { "type": "object", "properties": { "role": { "enum": [ "system", "developer", "user", "assistant" ] }, "content": { "type": "string" } }, "required": [ "role", "content" ], "additionalProperties": false } }, "append": { "type": "array", "items": { "type": "object", "properties": { "role": { "enum": [ "system", "developer", "user", "assistant" ] }, "content": { "type": "string" } }, "required": [ "role", "content" ], "additionalProperties": false } }, "user_prefix": { "type": "string", "minLength": 1, "maxLength": 10000, "description": "Added before the first text of the last user message." }, "user_suffix": { "type": "string", "minLength": 1, "maxLength": 10000, "description": "Added after the last text of the last user message." } }, "additionalProperties": false }, "llm_judge": { "type": "object", "description": "`llm_judge` settings: the Model asked and the operator prompt, whose `{{content}}` receives the inspected text.", "properties": { "model": { "$ref": "#/$defs/ModelName" }, "prompt": { "type": "string", "minLength": 1, "maxLength": 20000 }, "max_tokens": { "type": "integer", "minimum": 1, "maximum": 4096, "default": 256 } }, "required": [ "model", "prompt" ], "additionalProperties": false }, "json_schema": { "type": "object", "description": "`json_schema` settings.", "properties": { "schema": { "type": [ "object", "boolean" ], "description": "A JSON Schema 2020-12 the content must satisfy; required unless use_request_schema." }, "use_request_schema": { "type": "boolean", "description": "Validate against the request's own response schema when it has one.", "default": false }, "reask": { "type": "integer", "minimum": 0, "maximum": 5, "description": "How many times a non-streaming or buffered response that fails is asked for again.", "default": 0 } }, "additionalProperties": false, "if": { "not": { "properties": { "use_request_schema": { "const": true } }, "required": [ "use_request_schema" ] } }, "then": { "required": [ "schema" ] } }, "tool_permission": { "type": "object", "description": "`tool_permission` settings.", "properties": { "allow": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 256 }, "maxItems": 1024, "default": [] }, "deny": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 256 }, "maxItems": 1024, "default": [] } }, "additionalProperties": false }, "length": { "type": "object", "description": "`length` settings: bounds on characters, words or estimated tokens.", "properties": { "min_chars": { "type": "integer", "minimum": 0 }, "max_chars": { "type": "integer", "minimum": 0 }, "min_words": { "type": "integer", "minimum": 0 }, "max_words": { "type": "integer", "minimum": 0 }, "min_tokens": { "type": "integer", "minimum": 0 }, "max_tokens": { "type": "integer", "minimum": 0 } }, "minProperties": 1, "additionalProperties": false }, "classifier": { "type": "object", "description": "`classifier` settings: a text-classification endpoint answering `[{label, score}]` per input; the guardrail's `categories` maps labels to categories.", "properties": { "url": { "$ref": "#/$defs/HttpsUrl" }, "headers": { "$ref": "#/$defs/HeaderValues" }, "thresholds": { "type": "object", "description": "Label → the score at or above which it is a finding.", "additionalProperties": { "$ref": "#/$defs/Ratio" }, "minProperties": 1 }, "max_inputs_per_call": { "type": "integer", "minimum": 1, "maximum": 1024, "default": 32 }, "max_chars": { "type": "integer", "minimum": 100, "maximum": 1000000, "default": 8000 }, "overlap_chars": { "type": "integer", "minimum": 0, "default": 200 } }, "required": [ "url", "thresholds" ], "additionalProperties": false }, "bedrock_guardrails": { "type": "object", "description": "`bedrock_guardrails` settings: Bedrock ApplyGuardrail, signed with a `bedrock` provider's AWS credentials.", "properties": { "provider": { "$ref": "#/$defs/ProviderName" }, "guardrail_id": { "type": "string", "minLength": 1, "maxLength": 2048 }, "guardrail_version": { "type": "string", "minLength": 1, "maxLength": 64, "default": "DRAFT" }, "region": { "type": "string", "minLength": 1, "description": "Default: the provider's `aws.region`, else us-east-1." }, "base_url": { "$ref": "#/$defs/HttpsUrl", "description": "Default: https://bedrock-runtime..amazonaws.com." } }, "required": [ "provider", "guardrail_id" ], "additionalProperties": false }, "azure_content_safety": { "type": "object", "description": "`azure_content_safety` settings: Azure AI Content Safety text analysis.", "properties": { "endpoint": { "$ref": "#/$defs/HttpsUrl" }, "api_key": { "$ref": "#/$defs/Secret" }, "api_version": { "type": "string", "minLength": 1, "default": "2024-09-01" }, "severity_threshold": { "type": "integer", "minimum": 0, "maximum": 7, "default": 4 } }, "required": [ "endpoint", "api_key" ], "additionalProperties": false }, "model_armor": { "type": "object", "description": "`model_armor` settings: Model Armor sanitize calls, authorised with a `vertex` provider's GCP credentials.", "properties": { "provider": { "$ref": "#/$defs/ProviderName" }, "template": { "type": "string", "minLength": 1 }, "project": { "type": "string", "minLength": 1, "description": "Default: the provider's `gcp.project`." }, "location": { "type": "string", "minLength": 1, "description": "Default: the provider's `gcp.location`." }, "base_url": { "$ref": "#/$defs/HttpsUrl", "description": "Default: https://modelarmor..rep.googleapis.com." } }, "required": [ "provider", "template" ], "additionalProperties": false }, "lakera": { "type": "object", "description": "`lakera` settings: Lakera Guard v2.", "properties": { "api_key": { "$ref": "#/$defs/Secret" }, "base_url": { "$ref": "#/$defs/HttpsUrl", "default": "https://api.lakera.ai" }, "project_id": { "type": "string", "minLength": 1 } }, "required": [ "api_key" ], "additionalProperties": false }, "template": { "type": "object", "description": "`template` settings (-072, -073): named message templates with {{variable}} placeholders, rendered from the request's `template` object.", "properties": { "templates": { "type": "object", "propertyNames": { "type": "string", "pattern": "^[A-Za-z0-9_.-]{1,128}$" }, "additionalProperties": { "type": "object", "properties": { "messages": { "type": "array", "minItems": 1, "maxItems": 256, "items": { "type": "object", "properties": { "role": { "enum": [ "system", "developer", "user", "assistant" ] }, "content": { "type": "string", "maxLength": 100000, "description": "Text with {{name}} placeholders (a letter or `_`, then letters, digits or `_`; spaces inside the braces allowed)." } }, "required": [ "role", "content" ], "additionalProperties": false } } }, "required": [ "messages" ], "additionalProperties": false }, "minProperties": 1 }, "required": { "type": "boolean", "description": ": requests it applies to must carry a `template` object.", "default": false } }, "required": [ "templates" ], "additionalProperties": false }, "llm_rewrite": { "type": "object", "description": "`llm_rewrite` settings: the Model asked and the operator prompt (its system message); the in-scope segments are sent as {\"segments\": [{\"id\", \"text\"}]}.", "properties": { "model": { "$ref": "#/$defs/ModelName" }, "prompt": { "type": "string", "minLength": 1, "maxLength": 20000 }, "max_tokens": { "type": "integer", "minimum": 1, "maximum": 32768, "default": 1024 } }, "required": [ "model", "prompt" ], "additionalProperties": false }, "json_repair": { "type": "object", "description": "`json_repair`: no settings.", "additionalProperties": false }, "topic": { "type": "object", "description": "`topic` settings: an embeddings Model and topic descriptions; at least one of allowed and denied is non-empty.", "properties": { "embedding_model": { "$ref": "#/$defs/ModelName" }, "allowed": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 2000 }, "maxItems": 256, "default": [] }, "denied": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 2000 }, "maxItems": 256, "default": [] }, "threshold": { "$ref": "#/$defs/Ratio", "default": 0.5 } }, "required": [ "embedding_model" ], "additionalProperties": false }, "severity": { "$ref": "#/$defs/Severity" }, "description": { "type": "string", "maxLength": 1000 }, "notify": { "type": "object", "properties": { "min_severity": { "$ref": "#/$defs/Severity", "default": "high" } }, "additionalProperties": false } }, "required": [ "type" ], "additionalProperties": false, "allOf": [ { "if": { "not": { "properties": { "type": { "enum": [ "regex" ] } }, "required": [ "type" ] } }, "then": { "properties": { "regex": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "keywords" ] } }, "required": [ "type" ] } }, "then": { "properties": { "keywords": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "pii" ] } }, "required": [ "type" ] } }, "then": { "properties": { "pii": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "secrets" ] } }, "required": [ "type" ] } }, "then": { "properties": { "secrets": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "moderation" ] } }, "required": [ "type" ] } }, "then": { "properties": { "moderation": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "webhook" ] } }, "required": [ "type" ] } }, "then": { "properties": { "webhook": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "system_prompt" ] } }, "required": [ "type" ] } }, "then": { "properties": { "system_prompt": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "decorator" ] } }, "required": [ "type" ] } }, "then": { "properties": { "decorator": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "llm_judge" ] } }, "required": [ "type" ] } }, "then": { "properties": { "llm_judge": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "json_schema" ] } }, "required": [ "type" ] } }, "then": { "properties": { "json_schema": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "tool_permission" ] } }, "required": [ "type" ] } }, "then": { "properties": { "tool_permission": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "length" ] } }, "required": [ "type" ] } }, "then": { "properties": { "length": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "classifier" ] } }, "required": [ "type" ] } }, "then": { "properties": { "classifier": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "bedrock_guardrails" ] } }, "required": [ "type" ] } }, "then": { "properties": { "bedrock_guardrails": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "azure_content_safety" ] } }, "required": [ "type" ] } }, "then": { "properties": { "azure_content_safety": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "model_armor" ] } }, "required": [ "type" ] } }, "then": { "properties": { "model_armor": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "lakera" ] } }, "required": [ "type" ] } }, "then": { "properties": { "lakera": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "template" ] } }, "required": [ "type" ] } }, "then": { "properties": { "template": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "llm_rewrite" ] } }, "required": [ "type" ] } }, "then": { "properties": { "llm_rewrite": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "json_repair" ] } }, "required": [ "type" ] } }, "then": { "properties": { "json_repair": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "topic" ] } }, "required": [ "type" ] } }, "then": { "properties": { "topic": false } } }, { "if": { "properties": { "action": { "const": "redact" } }, "required": [ "action" ] }, "then": { "properties": { "type": { "enum": [ "regex", "keywords", "pii", "secrets", "webhook", "tool_permission", "bedrock_guardrails", "azure_content_safety", "model_armor", "lakera", "llm_rewrite" ] } } } }, { "if": { "properties": { "execution": { "const": "async" } }, "required": [ "execution" ] }, "then": { "required": [ "action" ], "properties": { "action": { "const": "flag" }, "on_error": { "const": "allow" } } } }, { "if": { "properties": { "action": { "const": "flag" } }, "required": [ "action" ] }, "then": { "properties": { "on_error": { "const": "allow" } } } }, { "if": { "properties": { "type": { "enum": [ "system_prompt", "decorator", "template", "json_repair" ] } }, "required": [ "type" ] }, "then": { "properties": { "action": false, "on_error": false, "execution": false } } }, { "if": { "required": [ "type", "regex" ], "properties": { "type": { "const": "regex" }, "regex": { "required": [ "allow" ], "properties": { "allow": { "minItems": 1 } } } } }, "then": { "properties": { "action": { "enum": [ "block", "flag" ] } } } }, { "if": { "not": { "properties": { "action": { "enum": [ "divert" ] } }, "required": [ "action" ] } }, "then": { "properties": { "divert_to": false } } }, { "if": { "properties": { "action": { "const": "divert" } }, "required": [ "action" ] }, "then": { "required": [ "divert_to" ] } }, { "if": { "properties": { "type": { "const": "llm_judge" } }, "required": [ "type" ] }, "then": { "required": [ "llm_judge" ] } }, { "if": { "properties": { "type": { "const": "classifier" } }, "required": [ "type" ] }, "then": { "required": [ "classifier" ] } }, { "if": { "properties": { "type": { "const": "bedrock_guardrails" } }, "required": [ "type" ] }, "then": { "required": [ "bedrock_guardrails" ] } }, { "if": { "properties": { "type": { "const": "azure_content_safety" } }, "required": [ "type" ] }, "then": { "required": [ "azure_content_safety" ] } }, { "if": { "properties": { "type": { "const": "model_armor" } }, "required": [ "type" ] }, "then": { "required": [ "model_armor" ] } }, { "if": { "properties": { "type": { "const": "lakera" } }, "required": [ "type" ] }, "then": { "required": [ "lakera" ] } }, { "if": { "properties": { "type": { "const": "llm_rewrite" } }, "required": [ "type" ] }, "then": { "required": [ "llm_rewrite" ], "properties": { "action": { "const": "redact" }, "execution": { "const": "blocking" } } } }, { "if": { "properties": { "type": { "const": "topic" } }, "required": [ "type" ] }, "then": { "required": [ "topic" ] } }, { "if": { "properties": { "type": { "const": "template" } }, "required": [ "type" ] }, "then": { "required": [ "template" ] } }, { "if": { "properties": { "action": { "const": "divert" } }, "required": [ "action" ] }, "then": { "properties": { "type": { "not": { "enum": [ "system_prompt", "decorator", "template", "json_repair", "json_schema", "llm_rewrite" ] } }, "execution": { "const": "blocking" } } } } ] }, "Guardrails": { "type": "object", "description": "Top-level `guardrails` singleton: settings plus `definitions`, the map served as the `/guardrails` collection. `replacement: hash` requires `hash_key`.", "properties": { "hash_key": { "$ref": "#/$defs/Secret" }, "expose_results": { "type": "boolean", "default": true }, "on_uninspectable": { "enum": [ "skip", "block" ], "default": "skip" }, "definitions": { "type": "object", "propertyNames": { "$ref": "#/$defs/GuardrailName" }, "additionalProperties": { "$ref": "#/$defs/Guardrail" } } }, "additionalProperties": false, "allOf": [ { "if": { "properties": { "definitions": { "not": { "additionalProperties": { "not": { "properties": { "replacement": { "const": "hash" } }, "required": [ "replacement" ] } } } } }, "required": [ "definitions" ] }, "then": { "required": [ "hash_key" ] } } ] }, "PolicyGuardrails": { "type": "object", "description": "`policies.guardrails` member.", "properties": { "input": { "type": "array", "items": { "$ref": "#/$defs/GuardrailName" }, "uniqueItems": true }, "output": { "type": "array", "items": { "$ref": "#/$defs/GuardrailName" }, "uniqueItems": true }, "mcp_input": { "type": "array", "items": { "$ref": "#/$defs/GuardrailName" }, "uniqueItems": true }, "mcp_output": { "type": "array", "items": { "$ref": "#/$defs/GuardrailName" }, "uniqueItems": true }, "exclude": { "type": "array", "items": { "$ref": "#/$defs/GuardrailName" }, "uniqueItems": true }, "locked": { "$ref": "#/$defs/FieldPaths" }, "request_overridable": { "$ref": "#/$defs/FieldPaths" }, "execution_order": { "enum": [ "parallel", "sequential" ], "default": "parallel" }, "request_selectable": { "type": "array", "items": { "$ref": "#/$defs/GuardrailName" }, "uniqueItems": true }, "streaming": { "type": "object", "properties": { "mode": { "enum": [ "auto", "buffer", "window", "observe", "reject" ], "default": "auto" }, "holdback_chars": { "type": "integer", "minimum": 16, "maximum": 65536, "default": 256 }, "max_buffer": { "$ref": "#/$defs/Size", "x-range": { "min": "64KiB", "max": "256MiB" } }, "buffer_heartbeat": { "anyOf": [ { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } }, { "type": "null" } ] }, "on_block": { "enum": [ "error", "finish" ], "default": "error" } }, "additionalProperties": false } }, "additionalProperties": false }, "Observability": { "type": "object", "description": "Top-level `observability`.", "properties": { "request_logs": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": true }, "include_unauthenticated": { "type": "boolean", "default": false }, "content": { "type": "object", "properties": { "max_body_bytes": { "$ref": "#/$defs/Size", "x-range": { "min": "1KiB", "max": "64MiB" }, "default": "1MiB" }, "log_upstream_error_bodies": { "type": "boolean", "default": false }, "upstream_error_body_max": { "$ref": "#/$defs/Size", "x-range": { "min": "256B", "max": "1MiB" }, "default": "16KiB" } }, "additionalProperties": false }, "headers": { "type": "object", "properties": { "request": { "type": "array", "items": { "$ref": "#/$defs/HeaderName" }, "default": [] }, "response": { "type": "array", "items": { "$ref": "#/$defs/HeaderName" }, "default": [] } }, "additionalProperties": false }, "client_ip": { "enum": [ "full", "truncated", "none" ], "default": "full" }, "user_agent": { "type": "boolean", "default": true }, "sinks": { "type": "object", "properties": { "store": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": true }, "retention": { "$ref": "#/$defs/Duration", "x-range": { "min": "1h" }, "default": "30d" }, "content_retention": { "$ref": "#/$defs/Duration", "x-range": { "min": "1h" }, "description": "≤ retention.", "default": "7d" }, "queue_capacity": { "type": "integer", "minimum": 100, "default": 10000 } }, "additionalProperties": false }, "stdout": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": false }, "include_content": { "type": "boolean", "default": false } }, "additionalProperties": false }, "http": { "type": "object", "description": "HttpSink map.", "propertyNames": { "allOf": [ { "$ref": "#/$defs/Name" }, { "not": { "enum": [ "store", "stdout" ] } } ] }, "additionalProperties": { "type": "object", "properties": { "url": { "$ref": "#/$defs/HttpsUrl" }, "headers": { "$ref": "#/$defs/HeaderValues" }, "format": { "enum": [ "ndjson", "json_array" ], "default": "ndjson" }, "include_content": { "type": "boolean", "default": false }, "batch_max_records": { "type": "integer", "minimum": 1, "maximum": 10000, "default": 500 }, "flush_interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "10ms", "max": "60s" }, "default": "1s" }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "10s" }, "queue_capacity": { "type": "integer", "minimum": 100, "default": 10000 }, "max_retry_duration": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" }, "default": "5m" }, "compression": { "enum": [ "gzip", "none" ], "default": "gzip" } }, "required": [ "url" ], "additionalProperties": false }, "default": {} }, "otlp": { "type": "object", "description": "OtlpLogSink map.", "propertyNames": { "allOf": [ { "$ref": "#/$defs/Name" }, { "not": { "enum": [ "store", "stdout" ] } } ] }, "additionalProperties": { "type": "object", "description": "OtlpLogSink: each record exported as one OTLP LogRecord whose body is the record's JSON and whose trace and span ids are the record's.", "properties": { "endpoint": { "$ref": "#/$defs/Url", "description": "Base URL of the collector; egress subject to HTTP protocols post to /v1/logs, gRPC calls the LogsService at the endpoint." }, "protocol": { "enum": [ "grpc", "http/protobuf", "http/json" ], "default": "http/protobuf" }, "headers": { "$ref": "#/$defs/HeaderValues", "default": {} }, "include_content": { "type": "boolean", "default": false }, "batch_max_records": { "type": "integer", "minimum": 1, "maximum": 10000, "default": 512 }, "flush_interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "10ms", "max": "60s" }, "default": "1s" }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "10s" }, "queue_capacity": { "type": "integer", "minimum": 100, "default": 10000 }, "max_retry_duration": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" }, "default": "5m" }, "compression": { "enum": [ "gzip", "none" ], "default": "gzip", "description": "Ignored by grpc." } }, "required": [ "endpoint" ], "additionalProperties": false }, "default": {} }, "langfuse": { "type": "object", "propertyNames": { "allOf": [ { "$ref": "#/$defs/Name" }, { "not": { "enum": [ "store", "stdout" ] } } ] }, "additionalProperties": { "type": "object", "description": "LangfuseSink: a trace-ingestion exporter; one trace per record and one generation per attempt, posted to /api/public/ingestion with basic authentication.", "properties": { "url": { "$ref": "#/$defs/HttpsUrl", "description": "Base URL of the ingestion service; egress subject to" }, "public_key": { "type": "string", "minLength": 1, "maxLength": 256 }, "secret_key": { "$ref": "#/$defs/Secret" }, "environment": { "anyOf": [ { "type": "string", "minLength": 1, "maxLength": 128 }, { "type": "null" } ], "default": null }, "include_content": { "type": "boolean", "default": false }, "batch_max_records": { "type": "integer", "minimum": 1, "maximum": 1000, "default": 100 }, "flush_interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "10ms", "max": "60s" }, "default": "1s" }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "10s" }, "queue_capacity": { "type": "integer", "minimum": 100, "default": 10000 }, "max_retry_duration": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" }, "default": "5m" } }, "required": [ "url", "public_key", "secret_key" ], "additionalProperties": false }, "default": {} } }, "additionalProperties": false }, "shutdown_flush_timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s", "max": "5m" }, "default": "10s" }, "export_max_rows": { "type": "integer", "minimum": 1, "maximum": 10000000, "default": 100000 } }, "additionalProperties": false }, "metrics": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": true }, "path": { "type": "string", "pattern": "^/", "default": "/metrics" }, "auth": { "enum": [ "required", "none" ], "default": "required" }, "tenant_labels": { "type": "array", "items": { "enum": [ "organization", "team", "project" ] }, "uniqueItems": true, "default": [] }, "custom_labels": { "type": "object", "propertyNames": { "type": "string", "pattern": "^[a-zA-Z_][a-zA-Z0-9_]*$" }, "additionalProperties": { "type": "object", "properties": { "from_metadata": { "type": "string", "minLength": 1 }, "allowed_values": { "type": "array", "items": { "type": "string" }, "minItems": 1, "maxItems": 50, "uniqueItems": true }, "other_value": { "type": "string", "default": "_other" }, "families": { "type": "array", "items": { "type": "string", "pattern": "^antirion_[a-z0-9_]+$" }, "minItems": 1 } }, "required": [ "from_metadata", "allowed_values" ], "additionalProperties": false }, "default": {} }, "max_label_value_bytes": { "type": "integer", "minimum": 16, "maximum": 1024, "default": 128 }, "max_series_per_family": { "type": "integer", "minimum": 100, "maximum": 1000000, "default": 10000 }, "buckets": { "type": "object", "description": "; strictly increasing.", "propertyNames": { "type": "string", "pattern": "^antirion_[a-z0-9_]+$" }, "additionalProperties": { "type": "array", "items": { "type": "number", "exclusiveMinimum": 0 }, "minItems": 1, "uniqueItems": true }, "default": {} }, "exclude_families": { "type": "array", "items": { "type": "string", "pattern": "^[a-z_][a-z0-9_]*$" }, "uniqueItems": true, "default": [] }, "otlp": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": false }, "endpoint": { "anyOf": [ { "$ref": "#/$defs/Url" }, { "type": "null" } ], "default": null }, "protocol": { "enum": [ "grpc", "http/protobuf", "http/json" ], "default": "http/protobuf" }, "interval": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "15s" }, "headers": { "$ref": "#/$defs/HeaderValues", "default": {} } }, "additionalProperties": false } }, "additionalProperties": false }, "traces": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": false }, "service_name": { "type": "string", "minLength": 1, "default": "antirion" }, "resource_attributes": { "$ref": "#/$defs/StringMap", "default": {} }, "exporter": { "type": "object", "properties": { "protocol": { "enum": [ "grpc", "http/protobuf", "http/json" ], "default": "grpc" }, "endpoint": { "anyOf": [ { "$ref": "#/$defs/Url" }, { "type": "null" } ], "default": null }, "headers": { "$ref": "#/$defs/HeaderValues", "default": {} }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "100ms", "max": "60s" }, "default": "10s" }, "compression": { "enum": [ "gzip", "none" ], "default": "gzip" }, "tls": { "$ref": "#/$defs/ClientTls", "default": {} } }, "additionalProperties": false }, "sampler": { "type": "object", "properties": { "type": { "enum": [ "parent_based_ratio", "ratio", "always_on", "always_off" ], "default": "parent_based_ratio" }, "ratio": { "$ref": "#/$defs/Ratio", "default": 1.0 } }, "additionalProperties": false }, "propagate_to_upstream": { "type": "boolean", "default": true }, "header_attributes": { "type": "object", "description": "Request header → span attribute; credential headers are rejected.", "propertyNames": { "allOf": [ { "$ref": "#/$defs/HeaderName" }, { "not": { "pattern": "^([Aa][Uu][Tt][Hh][Oo][Rr][Ii][Zz][Aa][Tt][Ii][Oo][Nn]|[Pp][Rr][Oo][Xx][Yy]-[Aa][Uu][Tt][Hh][Oo][Rr][Ii][Zz][Aa][Tt][Ii][Oo][Nn]|[Xx]-[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Xx]-[Gg][Oo][Oo][Gg]-[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Cc][Oo][Oo][Kk][Ii][Ee]|[Ss][Ee][Tt]-[Cc][Oo][Oo][Kk][Ii][Ee])$" } } ] }, "additionalProperties": { "type": "string", "minLength": 1 }, "default": {} }, "include_end_user": { "type": "boolean", "default": false }, "batch": { "type": "object", "properties": { "max_queue_size": { "type": "integer", "minimum": 64, "default": 2048 }, "max_export_batch_size": { "type": "integer", "minimum": 1, "default": 512 }, "schedule_delay": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "1s" } }, "additionalProperties": false }, "viewer_url": { "description": "Link template of an external trace viewer: `{trace_id}` (and optionally `{span_id}`) is replaced by the record's ids; reported by `GET /admin/v1/status` as `trace_viewer_url` for the console's request detail.", "anyOf": [ { "type": "string", "maxLength": 2048, "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://[^\\s]*\\{trace_id\\}[^\\s]*$" }, { "type": "null" } ], "default": null } }, "additionalProperties": false, "allOf": [ { "if": { "properties": { "enabled": { "const": true } }, "required": [ "enabled" ] }, "then": { "required": [ "exporter" ], "properties": { "exporter": { "required": [ "endpoint" ], "properties": { "endpoint": { "type": "string" } } } } } } ] }, "metadata": { "type": "object", "properties": { "max_entries": { "type": "integer", "minimum": 0, "maximum": 100, "default": 20 }, "max_value_bytes": { "type": "integer", "minimum": 1, "maximum": 4096, "default": 256 } }, "additionalProperties": false }, "response_headers": { "type": "object", "properties": { "upstream_request_id": { "type": "boolean", "default": true }, "version": { "type": "boolean", "default": false } }, "additionalProperties": false }, "alerts": { "type": "object", "properties": { "webhooks": { "type": "object", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "object", "properties": { "url": { "$ref": "#/$defs/HttpsUrl" }, "events": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 }, "signing_secret": { "anyOf": [ { "$ref": "#/$defs/Secret" }, { "type": "null" } ] }, "headers": { "$ref": "#/$defs/HeaderValues", "default": {} }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "5s" }, "max_retry_duration": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" }, "default": "1h" }, "queue_capacity": { "type": "integer", "minimum": 1, "default": 1000 }, "enabled": { "type": "boolean", "default": true } }, "required": [ "url", "events" ], "additionalProperties": false }, "default": {} }, "evaluation_interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "10s", "max": "15m" }, "default": "1m" }, "instance_retention": { "$ref": "#/$defs/Duration", "x-range": { "min": "1d", "max": "400d" }, "default": "90d" }, "rules": { "type": "object", "description": "Alert rules.", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": true }, "kind": { "enum": [ "metric", "event" ], "default": "metric" }, "category": { "enum": [ "latency", "errors", "availability", "capacity", "budget", "cost", "safety", "pii", "cache", "security", "anomaly" ] }, "severity": { "enum": [ "critical", "warning", "info" ], "default": "warning" }, "metric": { "enum": [ "p95_latency_ms", "p99_latency_ms", "ttft_p95_ms", "error_rate", "upstream_5xx_rate", "fallback_rate", "rpm_utilization", "tpm_utilization", "cost_per_request_usd", "spend_usd", "budget_projection_ratio", "guardrail_events", "cache_hit_rate", "latency_baseline_ratio", "cost_baseline_ratio", "requests" ] }, "operator": { "enum": [ "gt", "gte", "lt", "lte" ], "default": "gt" }, "threshold": { "type": "number" }, "events": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 128 }, "minItems": 1 }, "scope": { "type": "object", "properties": { "provider": { "type": "string", "minLength": 1, "maxLength": 256 }, "deployment": { "type": "string", "minLength": 1, "maxLength": 256 }, "model": { "type": "string", "minLength": 1, "maxLength": 256 }, "route": { "type": "string", "minLength": 1, "maxLength": 256 }, "organization": { "type": "string", "minLength": 1, "maxLength": 256 }, "team": { "type": "string", "minLength": 1, "maxLength": 256 }, "project": { "type": "string", "minLength": 1, "maxLength": 256 }, "key": { "type": "string", "minLength": 1, "maxLength": 256 } }, "additionalProperties": false }, "window": { "$ref": "#/$defs/Duration", "x-range": { "min": "1m", "max": "24h" }, "default": "5m" }, "for": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s", "max": "24h" }, "default": "0s" }, "cooldown": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s", "max": "7d" }, "default": "15m" }, "resolve_after": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s", "max": "24h" }, "default": "5m" }, "channels": { "type": "array", "items": { "$ref": "#/$defs/Name" }, "default": [] }, "escalation": { "type": "array", "items": { "$ref": "#/$defs/Name" }, "default": [] }, "owner_team": { "$ref": "#/$defs/TenantName" }, "runbook_url": { "$ref": "#/$defs/Url" }, "description": { "type": "string", "maxLength": 1000 }, "silence_during_maintenance": { "type": "boolean", "description": "Instances that fire while a maintenance window is current are created snoozed until its end, and refires inside one notify no one.", "default": false } }, "required": [ "category" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "kind": { "const": "event" } }, "required": [ "kind" ] }, "then": { "required": [ "events" ] }, "else": { "required": [ "metric", "threshold" ] } } ] }, "default": {} }, "channels": { "type": "object", "description": "Alert channels.", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "object", "properties": { "type": { "enum": [ "slack", "pagerduty", "email", "webhook" ] }, "enabled": { "type": "boolean", "default": true }, "min_severity": { "enum": [ "critical", "warning", "info" ], "default": "info" }, "slack": { "type": "object", "properties": { "webhook_url": { "$ref": "#/$defs/Secret" } }, "required": [ "webhook_url" ], "additionalProperties": false }, "pagerduty": { "type": "object", "properties": { "routing_key": { "$ref": "#/$defs/Secret" }, "events_url": { "$ref": "#/$defs/HttpsUrl", "default": "https://events.pagerduty.com/v2/enqueue" } }, "required": [ "routing_key" ], "additionalProperties": false }, "email": { "type": "object", "properties": { "to": { "type": "array", "items": { "type": "string", "minLength": 3, "maxLength": 320 }, "minItems": 1, "maxItems": 50 } }, "required": [ "to" ], "additionalProperties": false }, "webhook": { "type": "object", "properties": { "webhook": { "$ref": "#/$defs/Name" } }, "required": [ "webhook" ], "additionalProperties": false } }, "required": [ "type" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "type": { "const": "slack" } }, "required": [ "type" ] }, "then": { "required": [ "slack" ] } }, { "if": { "properties": { "type": { "const": "pagerduty" } }, "required": [ "type" ] }, "then": { "required": [ "pagerduty" ] } }, { "if": { "properties": { "type": { "const": "email" } }, "required": [ "type" ] }, "then": { "required": [ "email" ] } }, { "if": { "properties": { "type": { "const": "webhook" } }, "required": [ "type" ] }, "then": { "required": [ "webhook" ] } } ] }, "default": {} } }, "additionalProperties": false }, "feedback": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": false }, "max_age": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "30d" }, "metrics": { "type": "object", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "object", "properties": { "type": { "enum": [ "boolean", "number", "text" ] }, "min": { "type": "number" }, "max": { "type": "number" }, "max_bytes": { "type": "integer", "minimum": 1, "default": 4096 } }, "required": [ "type" ], "additionalProperties": false }, "default": {} } }, "additionalProperties": false }, "environment_tag": { "type": "string", "minLength": 1, "maxLength": 64, "default": "env", "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$" }, "geoip": { "type": "object", "properties": { "database": { "anyOf": [ { "type": "string", "minLength": 1, "maxLength": 1024 }, { "type": "null" } ], "default": null } }, "additionalProperties": false }, "slos": { "type": "object", "description": "Service-level objectives.", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "object", "properties": { "kind": { "enum": [ "availability", "latency" ], "default": "availability" }, "objective": { "$ref": "#/$defs/Ratio" }, "latency_threshold_ms": { "type": "number", "exclusiveMinimum": 0 }, "window": { "$ref": "#/$defs/Duration", "x-range": { "min": "1d", "max": "90d" }, "default": "30d" }, "scope": { "type": "object", "properties": { "provider": { "type": "string", "minLength": 1, "maxLength": 256 }, "deployment": { "type": "string", "minLength": 1, "maxLength": 256 }, "model": { "type": "string", "minLength": 1, "maxLength": 256 }, "route": { "type": "string", "minLength": 1, "maxLength": 256 }, "organization": { "type": "string", "minLength": 1, "maxLength": 256 }, "team": { "type": "string", "minLength": 1, "maxLength": 256 }, "project": { "type": "string", "minLength": 1, "maxLength": 256 }, "key": { "type": "string", "minLength": 1, "maxLength": 256 } }, "additionalProperties": false } }, "required": [ "objective" ], "additionalProperties": false }, "default": {} } }, "additionalProperties": false }, "PolicyObservability": { "type": "object", "description": "`policies.observability` member.", "properties": { "content": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": false }, "redact_pii": { "type": "boolean", "default": false }, "on_pii": { "enum": [ "mask", "hash", "drop_content" ], "default": "mask" } }, "additionalProperties": false }, "zero_data_retention": { "type": "boolean", "default": false }, "traces": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": true }, "sample_ratio": { "$ref": "#/$defs/Ratio" } }, "additionalProperties": false }, "request_overridable": { "$ref": "#/$defs/FieldPaths", "default": [] }, "locked": { "$ref": "#/$defs/FieldPaths", "default": [] } }, "additionalProperties": false }, "PolicyHeaders": { "type": "object", "description": "`policies.headers` member (`expose_upstream_identity`).", "properties": { "forward": { "type": "array", "description": "; entries on the always-deny list are errors.", "items": { "$ref": "#/$defs/ForwardPattern" }, "default": [] }, "deny": { "type": "array", "items": { "type": "string", "pattern": "^[!#$%&'+.^_`|~0-9A-Za-z-]*\\*?$", "minLength": 1 }, "default": [] }, "set": { "type": "object", "propertyNames": { "allOf": [ { "$ref": "#/$defs/ForwardableHeaderName" }, { "$ref": "#/$defs/NotReservedName" } ] }, "additionalProperties": { "anyOf": [ { "type": "string" }, { "$ref": "#/$defs/Secret" } ] }, "default": {} }, "response_forward": { "type": "array", "items": { "$ref": "#/$defs/ForwardPattern" }, "default": [] }, "expose_upstream_identity": { "type": "boolean", "default": true }, "locked": { "$ref": "#/$defs/FieldPaths" }, "request_overridable": { "$ref": "#/$defs/FieldPaths" } }, "additionalProperties": false }, "McpServer": { "type": "object", "description": "An MCP server.", "properties": { "transport": { "enum": [ "streamable_http", "sse", "stdio", "openapi" ] }, "enabled": { "type": "boolean", "description": ": false keeps it validated and referenceable, and the data plane treats it as absent.", "default": true }, "url": { "$ref": "#/$defs/HttpsUrl" }, "protocol": { "enum": [ "auto", "legacy", "modern" ], "default": "auto" }, "discovery_ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "1s" }, "default": "5m" }, "prefix": { "$ref": "#/$defs/McpName" }, "headers": { "$ref": "#/$defs/HeaderValues" }, "auth": { "type": "object", "required": [ "type" ], "description": "Upstream credentials: `oauth_client_credentials` obtains a token for the server, `token_exchange` exchanges the caller's JWT for one (RFC 8693).", "properties": { "type": { "enum": [ "none", "oauth_client_credentials", "token_exchange" ] }, "token_url": { "$ref": "#/$defs/HttpsUrl", "description": "The token endpoint." }, "client_id": { "type": "string", "minLength": 1 }, "client_secret": { "$ref": "#/$defs/Secret" }, "client_auth": { "enum": [ "basic", "post" ], "default": "basic", "description": "HTTP Basic (RFC 6749 §2.3.1) or `client_id` and `client_secret` in the form." }, "scopes": { "type": "array", "items": { "type": "string", "minLength": 1 }, "default": [] }, "resource": { "anyOf": [ { "$ref": "#/$defs/Url" }, { "type": "null" } ], "description": "RFC 8707 `resource`; default the server's `url`, null to send none." }, "audience": { "type": "string", "minLength": 1 }, "subject_token_type": { "type": "string", "minLength": 1, "default": "urn:ietf:params:oauth:token-type:jwt" }, "requested_token_type": { "type": "string", "minLength": 1, "default": "urn:ietf:params:oauth:token-type:access_token" } }, "additionalProperties": false, "allOf": [ { "if": { "properties": { "type": { "const": "none" } } }, "then": { "properties": { "type": true }, "additionalProperties": false } }, { "if": { "properties": { "type": { "enum": [ "oauth_client_credentials", "token_exchange" ] } } }, "then": { "required": [ "token_url", "client_id" ] } }, { "if": { "properties": { "type": { "const": "oauth_client_credentials" } } }, "then": { "required": [ "client_secret" ], "properties": { "subject_token_type": false, "requested_token_type": false } } } ] }, "client_headers": { "type": "array", "items": { "$ref": "#/$defs/HeaderName" }, "default": [] }, "identity_headers": { "type": "object", "propertyNames": { "$ref": "#/$defs/HeaderName" }, "additionalProperties": { "type": "string", "pattern": "^(key_id|key_name|project|team|organization|user|end_user|tags|jwt\\..+)$" } }, "tools": { "type": "object", "properties": { "include": { "type": "array", "items": { "$ref": "#/$defs/Glob" }, "default": [ "*" ] }, "exclude": { "type": "array", "items": { "$ref": "#/$defs/Glob" }, "default": [] } }, "additionalProperties": false }, "prompts": { "type": "object", "properties": { "include": { "type": "array", "items": { "$ref": "#/$defs/Glob" } }, "exclude": { "type": "array", "items": { "$ref": "#/$defs/Glob" } } }, "additionalProperties": false }, "resources": { "type": "object", "properties": { "include": { "type": "array", "items": { "$ref": "#/$defs/Glob" } }, "exclude": { "type": "array", "items": { "$ref": "#/$defs/Glob" } } }, "additionalProperties": false }, "tool_cache_ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" } }, "init_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "10s" }, "request_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } }, "stream_idle_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } }, "retries": { "type": "integer", "minimum": 0, "maximum": 3 }, "command": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "null" } ] }, "args": { "type": "array", "items": { "type": "string" }, "default": [] }, "env": { "type": "object", "additionalProperties": { "anyOf": [ { "type": "string" }, { "$ref": "#/$defs/Secret" } ] }, "default": {} }, "processes": { "type": "integer", "minimum": 1, "maximum": 64 }, "openapi": { "type": "object", "properties": { "spec": { "type": "string", "minLength": 1 }, "operations": { "type": "object", "properties": { "include": { "type": "array", "items": { "$ref": "#/$defs/Glob" } }, "exclude": { "type": "array", "items": { "$ref": "#/$defs/Glob" } } }, "additionalProperties": false } }, "required": [ "spec" ], "additionalProperties": false }, "pin_tool_definitions": { "type": "boolean", "description": "Hide a tool whose definition changed until it is approved again (`POST /mcp/servers/{name}:approve_tools`)." } }, "required": [ "transport" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "transport": { "enum": [ "streamable_http", "sse", "openapi" ] } } }, "then": { "required": [ "url" ] } }, { "if": { "not": { "properties": { "transport": { "const": "stdio" } } } }, "then": { "properties": { "command": false, "args": false, "env": false, "processes": false } }, "else": { "required": [ "command" ], "properties": { "command": { "type": "string" } } } }, { "if": { "not": { "properties": { "transport": { "enum": [ "openapi" ] } }, "required": [ "transport" ] } }, "then": { "properties": { "openapi": false } } }, { "if": { "properties": { "transport": { "const": "openapi" } }, "required": [ "transport" ] }, "then": { "required": [ "openapi" ] } } ] }, "Mcp": { "type": "object", "description": "Top-level `mcp`: resource definitions only.", "properties": { "session": { "type": "object", "properties": { "keys": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "integer", "minimum": 0, "maximum": 255 }, "secret": { "$ref": "#/$defs/Base64Key32" } }, "required": [ "id", "secret" ], "additionalProperties": false }, "minItems": 1 }, "max_lifetime": { "$ref": "#/$defs/Duration", "x-range": { "max": "30d", "gt": "0s" }, "default": "24h" } }, "additionalProperties": false }, "servers": { "type": "object", "propertyNames": { "$ref": "#/$defs/McpName" }, "additionalProperties": { "$ref": "#/$defs/McpServer" } }, "stdio": { "type": "object", "description": "; file only.", "properties": { "allowed_commands": { "type": "array", "items": { "type": "string", "pattern": "^/" } } }, "additionalProperties": false }, "admin_server": { "type": "object", "description": "The read-only MCP server at /admin/mcp on the admin listener.", "properties": { "enabled": { "type": "boolean", "default": false } }, "additionalProperties": false }, "gateways": { "type": "object", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "object", "properties": { "servers": { "type": "array", "items": { "$ref": "#/$defs/McpName" }, "minItems": 1, "uniqueItems": true }, "enabled": { "type": "boolean", "description": ": false keeps it validated and referenceable, and the data plane treats it as absent.", "default": true }, "prefix_mode": { "enum": [ "auto", "always", "never" ] }, "session_mode": { "enum": [ "stateful", "stateless" ], "default": "stateful" }, "on_server_failure": { "enum": [ "partial", "fail" ], "default": "partial" }, "tool_search": { "type": "boolean", "default": false, "description": "Tools/list answers only search_tools, get_tool_schema and call_tool." }, "server_info": { "anyOf": [ { "const": "upstream" }, { "type": "object", "properties": { "name": { "type": "string", "minLength": 1 }, "version": { "type": "string", "minLength": 1 }, "title": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "additionalProperties": false } ] }, "client_cache_max_ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" }, "default": "0s" }, "modern_bridge": { "type": "boolean" }, "allowed_origins": { "type": "array", "items": { "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9+.-]*://[^/\\s]+$" } }, "max_body": { "$ref": "#/$defs/Size", "x-range": { "gt": "0B" } }, "oauth": { "type": "object", "properties": { "resource": { "anyOf": [ { "$ref": "#/$defs/Url" }, { "type": "null" } ] }, "authorization_servers": { "type": "array", "items": { "$ref": "#/$defs/Url" }, "minItems": 1 }, "scopes_supported": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "audiences": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "proxy_registration": { "type": "boolean", "default": false, "description": "Relay RFC 7591 dynamic client registration to the first authorization server at `/mcp//register`." } }, "additionalProperties": false, "required": [ "authorization_servers" ] } }, "required": [ "servers" ], "additionalProperties": false } } }, "additionalProperties": false }, "A2a": { "type": "object", "description": "Top-level `a2a`.", "properties": { "agents": { "type": "object", "propertyNames": { "$ref": "#/$defs/McpName" }, "additionalProperties": { "type": "object", "properties": { "card_url": { "$ref": "#/$defs/HttpsUrl" }, "url": { "anyOf": [ { "$ref": "#/$defs/HttpsUrl" }, { "type": "null" } ] }, "protocol": { "enum": [ "auto", "0.3", "1.0" ], "default": "auto" }, "enabled": { "type": "boolean", "default": true }, "public_card": { "type": "boolean" }, "headers": { "$ref": "#/$defs/HeaderValues" }, "identity_headers": { "type": "object", "propertyNames": { "$ref": "#/$defs/HeaderName" }, "additionalProperties": { "type": "string", "pattern": "^(key_id|key_name|project|team|organization|user|end_user|tags|jwt\\..+)$" } }, "card_cache_ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" }, "default": "5m" }, "request_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } }, "stream_idle_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } }, "extra_methods": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true } }, "required": [ "card_url" ], "additionalProperties": false } } }, "additionalProperties": false }, "PolicyMcp": { "type": "object", "description": "`policies.mcp`: MCP grants and the server-side tool loop `mcp_tools`.", "properties": { "servers": { "type": "array", "items": { "anyOf": [ { "$ref": "#/$defs/McpName" }, { "const": "*" } ] }, "uniqueItems": true }, "tools": { "type": "object", "propertyNames": { "allOf": [ { "$ref": "#/$defs/McpName" }, { "$ref": "#/$defs/NotReservedName" } ] }, "additionalProperties": { "type": "array", "items": { "$ref": "#/$defs/Glob" } } }, "prompts": { "type": "object", "propertyNames": { "allOf": [ { "$ref": "#/$defs/McpName" }, { "$ref": "#/$defs/NotReservedName" } ] }, "additionalProperties": { "type": "array", "items": { "$ref": "#/$defs/Glob" } } }, "resources": { "type": "object", "propertyNames": { "allOf": [ { "$ref": "#/$defs/McpName" }, { "$ref": "#/$defs/NotReservedName" } ] }, "additionalProperties": { "type": "array", "items": { "$ref": "#/$defs/Glob" } } }, "when": { "type": "array", "description": "Conditional grants: the level also grants only what its matching rules grant together (a rule without `servers` grants every server); no matching rule grants nothing.", "items": { "type": "object", "properties": { "match": { "type": "array", "minItems": 1, "items": { "type": "object", "properties": { "attribute": { "type": "string", "pattern": "^(key_id|project|team|organization|tags|end_user|jwt\\..+)$" }, "operator": { "enum": [ "equals", "in", "glob", "present" ] }, "value": {} }, "required": [ "attribute", "operator" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "operator": { "enum": [ "equals", "glob" ] } } }, "then": { "required": [ "value" ], "properties": { "value": { "type": "string" } } } }, { "if": { "properties": { "operator": { "const": "in" } } }, "then": { "required": [ "value" ], "properties": { "value": { "type": "array", "items": { "type": "string" }, "minItems": 1 } } } }, { "if": { "properties": { "operator": { "const": "present" } } }, "then": { "properties": { "value": false } } } ] }, "description": "Conditions over identity attributes; all must hold. A condition on a missing attribute is false." }, "servers": { "type": "array", "items": { "anyOf": [ { "$ref": "#/$defs/McpName" }, { "const": "*" } ] }, "uniqueItems": true }, "tools": { "type": "object", "propertyNames": { "allOf": [ { "$ref": "#/$defs/McpName" }, { "$ref": "#/$defs/NotReservedName" } ] }, "additionalProperties": { "type": "array", "items": { "$ref": "#/$defs/Glob" } } }, "prompts": { "type": "object", "propertyNames": { "allOf": [ { "$ref": "#/$defs/McpName" }, { "$ref": "#/$defs/NotReservedName" } ] }, "additionalProperties": { "type": "array", "items": { "$ref": "#/$defs/Glob" } } }, "resources": { "type": "object", "propertyNames": { "allOf": [ { "$ref": "#/$defs/McpName" }, { "$ref": "#/$defs/NotReservedName" } ] }, "additionalProperties": { "type": "array", "items": { "$ref": "#/$defs/Glob" } } } }, "required": [ "match" ], "additionalProperties": false } }, "mcp_tools": { "$ref": "#/$defs/PolicyMcpTools" }, "locked": { "$ref": "#/$defs/FieldPaths" }, "request_overridable": { "$ref": "#/$defs/FieldPaths" } }, "additionalProperties": false }, "PolicyMcpModelRoute": { "type": "object", "description": "`policies.mcp` at model and route level: only the tool loop; grants attach gateway → key only.", "properties": { "mcp_tools": { "$ref": "#/$defs/PolicyMcpTools" }, "locked": { "$ref": "#/$defs/FieldPaths" }, "request_overridable": { "$ref": "#/$defs/FieldPaths" } }, "additionalProperties": false }, "PolicyA2a": { "type": "object", "description": "`policies.a2a`: A2A grants and the agent-run caps `agent_runs`.", "properties": { "agents": { "type": "array", "items": { "anyOf": [ { "$ref": "#/$defs/McpName" }, { "const": "*" } ] }, "uniqueItems": true }, "agent_runs": { "$ref": "#/$defs/PolicyAgentRuns" }, "locked": { "$ref": "#/$defs/FieldPaths" }, "request_overridable": { "$ref": "#/$defs/FieldPaths" } }, "additionalProperties": false }, "PolicyA2aModelRoute": { "type": "object", "description": "`policies.a2a` at model and route level: only the agent-run caps; grants attach gateway → key only.", "properties": { "agent_runs": { "$ref": "#/$defs/PolicyAgentRuns" }, "locked": { "$ref": "#/$defs/FieldPaths" }, "request_overridable": { "$ref": "#/$defs/FieldPaths" } }, "additionalProperties": false }, "PolicyMcpTools": { "type": "object", "description": "`policies.mcp.mcp_tools`: server-side tool loop.", "properties": { "servers": { "type": "array", "items": { "$ref": "#/$defs/McpName" }, "uniqueItems": true }, "auto_execute": { "type": "array", "items": { "$ref": "#/$defs/Glob" }, "default": [] }, "max_iterations": { "type": "integer", "minimum": 1, "maximum": 50, "default": 10 } }, "additionalProperties": false }, "PolicyAgentRuns": { "type": "object", "description": "`policies.a2a.agent_runs`.", "properties": { "max_model_calls": { "type": "integer", "minimum": 0 }, "max_tool_calls": { "type": "integer", "minimum": 0 }, "max_spend": { "$ref": "#/$defs/Money" } }, "additionalProperties": false }, "Plugin": { "type": "object", "description": "An extension.", "properties": { "type": { "enum": [ "webhook", "builtin", "wasm" ] }, "enabled": { "type": "boolean", "default": true }, "hooks": { "type": "array", "items": { "enum": [ "request", "response", "stream_chunk", "attempt" ] }, "minItems": 1, "uniqueItems": true }, "order": { "type": "integer", "minimum": -1000000, "maximum": 1000000, "default": 100 }, "on_error": { "enum": [ "fail_closed", "fail_open" ], "default": "fail_closed" }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "min": "1ms", "max": "30s" }, "default": "500ms" }, "include_body": { "type": "boolean", "default": true }, "config": { "type": "object", "description": "Opaque, passed to the extension (free-form)." }, "webhook": { "type": "object", "properties": { "url": { "$ref": "#/$defs/HttpsUrl" }, "headers": { "$ref": "#/$defs/HeaderValues" }, "signing_secret": { "anyOf": [ { "$ref": "#/$defs/Secret" }, { "type": "null" } ] }, "max_response_bytes": { "$ref": "#/$defs/Size", "x-range": { "max": "16MiB" }, "default": "1MiB" }, "forward_headers": { "type": "array", "description": "Credential headers are rejected.", "items": { "$ref": "#/$defs/NonCredentialHeaderName" }, "default": [] } }, "required": [ "url" ], "additionalProperties": false }, "builtin": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1 } }, "required": [ "name" ], "additionalProperties": false }, "wasm": { "type": "object", "properties": { "module": { "type": "string", "pattern": "^(file|oci)://" }, "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "max_memory": { "$ref": "#/$defs/Size", "x-range": { "max": "1GiB" }, "default": "64MiB" }, "max_duration": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "5ms" } }, "required": [ "module", "sha256" ], "additionalProperties": false, "description": "`sha256` is required for `file://` and `oci://` modules alike." } }, "required": [ "type" ], "additionalProperties": false, "allOf": [ { "if": { "not": { "properties": { "type": { "enum": [ "webhook" ] } }, "required": [ "type" ] } }, "then": { "properties": { "webhook": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "builtin" ] } }, "required": [ "type" ] } }, "then": { "properties": { "builtin": false } } }, { "if": { "not": { "properties": { "type": { "enum": [ "wasm" ] } }, "required": [ "type" ] } }, "then": { "properties": { "wasm": false } } }, { "if": { "properties": { "type": { "const": "webhook" } }, "required": [ "type" ] }, "then": { "required": [ "webhook" ] } }, { "if": { "properties": { "type": { "const": "builtin" } }, "required": [ "type" ] }, "then": { "required": [ "builtin" ] } }, { "if": { "properties": { "type": { "const": "wasm" } }, "required": [ "type" ] }, "then": { "required": [ "wasm" ] } }, { "if": { "properties": { "builtin": { "properties": { "name": { "const": "static_response" } }, "required": [ "name" ] } }, "required": [ "builtin" ] }, "then": { "properties": { "hooks": { "items": { "const": "request" } }, "config": { "type": "object", "description": "static_response config; extension config stays free-form.", "properties": { "content": { "type": "string" }, "finish_reason": { "enum": [ "stop", "length" ] } }, "required": [ "content" ] } }, "required": [ "config" ] } } ] }, "PolicyPlugins": { "type": "object", "description": "`policies.plugins` member.", "properties": { "attach": { "type": "array", "items": { "anyOf": [ { "$ref": "#/$defs/Name" }, { "type": "object", "properties": { "name": { "$ref": "#/$defs/Name" }, "locked": { "type": "boolean" } }, "required": [ "name" ], "additionalProperties": false } ] } }, "detach": { "type": "array", "items": { "$ref": "#/$defs/Name" } }, "locked": { "$ref": "#/$defs/FieldPaths" }, "request_overridable": { "$ref": "#/$defs/FieldPaths" } }, "additionalProperties": false }, "PoliciesGateway": { "type": "object", "description": "Top-level `policies`: gateway-level policies.", "properties": { "limits": { "$ref": "#/$defs/PolicyLimits" }, "budgets": { "$ref": "#/$defs/PolicyBudgets" }, "cache": { "$ref": "#/$defs/PolicyCache" }, "guardrails": { "$ref": "#/$defs/PolicyGuardrails" }, "resilience": { "$ref": "#/$defs/PolicyResilience" }, "headers": { "$ref": "#/$defs/PolicyHeaders" }, "streaming": { "$ref": "#/$defs/PolicyStreaming" }, "translation": { "$ref": "#/$defs/PolicyTranslation" }, "observability": { "$ref": "#/$defs/PolicyObservability" }, "plugins": { "$ref": "#/$defs/PolicyPlugins" }, "mcp": { "$ref": "#/$defs/PolicyMcp" }, "a2a": { "$ref": "#/$defs/PolicyA2a" } }, "additionalProperties": false }, "PoliciesTenant": { "$ref": "#/$defs/PoliciesGateway", "description": "`policies` at organization, team, project and key level. Same members as the gateway level." }, "PoliciesModelRoute": { "type": "object", "description": "`policies` at model and route level. Limits and budgets accumulate as at the model level; `mcp` and `a2a` carry only `mcp_tools` and `agent_runs`, since grants attach gateway → key only.", "properties": { "limits": { "$ref": "#/$defs/PolicyLimits" }, "budgets": { "$ref": "#/$defs/PolicyBudgets" }, "cache": { "$ref": "#/$defs/PolicyCache" }, "guardrails": { "$ref": "#/$defs/PolicyGuardrails" }, "resilience": { "$ref": "#/$defs/PolicyResilience" }, "headers": { "$ref": "#/$defs/PolicyHeaders" }, "streaming": { "$ref": "#/$defs/PolicyStreaming" }, "translation": { "$ref": "#/$defs/PolicyTranslation" }, "observability": { "$ref": "#/$defs/PolicyObservability" }, "plugins": { "$ref": "#/$defs/PolicyPlugins" }, "mcp": { "$ref": "#/$defs/PolicyMcpModelRoute" }, "a2a": { "$ref": "#/$defs/PolicyA2aModelRoute" } }, "additionalProperties": false }, "PoliciesNode": { "type": "object", "description": "`policies` on a route-tree node. Node limits and budgets accumulate and are reserved per attempt through the node (node rule).", "properties": { "resilience": { "$ref": "#/$defs/PolicyResilience" }, "cache": { "$ref": "#/$defs/PolicyCache" }, "guardrails": { "$ref": "#/$defs/PolicyGuardrails" }, "headers": { "$ref": "#/$defs/PolicyHeaders" }, "limits": { "$ref": "#/$defs/PolicyLimits" }, "budgets": { "$ref": "#/$defs/PolicyBudgets" } }, "additionalProperties": false }, "Admin": { "type": "object", "description": "Top-level `admin`, static.", "properties": { "listen": { "type": "string", "description": "host:port of the admin listener; default 127.0.0.1:8081.", "pattern": "^.+:[0-9]{1,5}$", "default": "127.0.0.1:8081" }, "config": { "type": "object", "properties": { "file": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "null" } ], "default": null }, "source": { "$ref": "#/$defs/Name", "default": "file" }, "prune": { "type": "boolean", "default": true }, "watch": { "type": "boolean", "description": "Standalone only.", "default": false }, "watch_debounce": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s", "max": "10s" }, "default": "500ms" }, "watch_poll_interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "1s" }, "default": "30s" }, "history_limit": { "type": "integer", "minimum": 1, "maximum": 10000, "default": 100 }, "lock_applied": { "type": "boolean", "default": false } }, "additionalProperties": false }, "api": { "type": "object", "properties": { "default_page_size": { "type": "integer", "minimum": 1, "maximum": 1000, "default": 100 }, "max_page_size": { "type": "integer", "minimum": 1, "maximum": 10000, "default": 1000 }, "max_document": { "$ref": "#/$defs/Size", "x-range": { "gt": "0B" }, "default": "10MiB" }, "max_wait": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" }, "default": "30s" }, "idempotency_ttl": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "24h" } }, "additionalProperties": false }, "audit": { "type": "object", "properties": { "retention": { "$ref": "#/$defs/Duration", "x-range": { "min": "1d" }, "default": "365d" }, "include_diffs": { "type": "boolean", "default": true } }, "additionalProperties": false }, "ui": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": true }, "path": { "type": "string", "pattern": "^/", "default": "/ui" }, "data_plane_url": { "anyOf": [ { "$ref": "#/$defs/Url" }, { "type": "null" } ], "default": null } }, "additionalProperties": false } }, "additionalProperties": false }, "Server": { "type": "object", "description": "Top-level `server`, static except `admission`.", "properties": { "listen": { "type": "string", "description": "host:port of the data-plane listener.", "pattern": "^.+:[0-9]{1,5}$", "default": "0.0.0.0:8080" }, "public_url": { "anyOf": [ { "$ref": "#/$defs/Url" }, { "type": "null" } ], "default": null }, "worker_threads": { "anyOf": [ { "type": "integer", "minimum": 1 }, { "type": "null" } ] }, "http": { "type": "object", "properties": { "http2": { "type": "boolean", "default": true }, "h2c": { "type": "boolean", "default": true }, "header_read_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "10s" }, "body_read_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "30s" }, "idle_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "620s" }, "write_stall_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "60s" }, "max_connections": { "type": "integer", "minimum": 1, "default": 100000 }, "h2": { "type": "object", "properties": { "max_concurrent_streams": { "type": "integer", "minimum": 1, "maximum": 65535, "default": 256 }, "stream_window": { "$ref": "#/$defs/Size", "x-range": { "min": "64KiB", "max": "16MiB" }, "default": "1MiB" }, "connection_window": { "$ref": "#/$defs/Size", "description": "≥ stream_window.", "default": "4MiB" }, "keepalive_interval": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "30s" }, "keepalive_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "10s" }, "max_resets_per_10s": { "type": "integer", "minimum": 1, "default": 200 } }, "additionalProperties": false } }, "additionalProperties": false }, "compression": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": true }, "algorithms": { "type": "array", "items": { "enum": [ "zstd", "br", "gzip" ] }, "uniqueItems": true, "default": [ "zstd", "br", "gzip" ] }, "min_size": { "$ref": "#/$defs/Size", "default": "1KiB" }, "stream": { "type": "boolean", "default": false } }, "additionalProperties": false }, "decompression": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": true }, "algorithms": { "type": "array", "items": { "enum": [ "gzip", "deflate", "br", "zstd" ] }, "uniqueItems": true, "default": [ "gzip", "deflate", "br", "zstd" ] } }, "additionalProperties": false }, "admission": { "type": "object", "description": "Dynamic.", "properties": { "max_in_flight": { "type": "integer", "minimum": 1, "default": 16384 }, "max_queue": { "type": "integer", "minimum": 0, "default": 4096 }, "queue_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "2s" }, "fairness": { "enum": [ "fifo", "project" ], "default": "fifo" }, "memory_high_watermark": { "anyOf": [ { "type": "null" }, { "$ref": "#/$defs/Size" }, { "$ref": "#/$defs/Ratio" } ], "default": null }, "memory_low_watermark": { "anyOf": [ { "type": "null" }, { "$ref": "#/$defs/Size" }, { "$ref": "#/$defs/Ratio" } ], "default": null } }, "additionalProperties": false, "allOf": [ { "if": { "properties": { "memory_high_watermark": { "not": { "type": "null" } } }, "required": [ "memory_high_watermark" ] }, "then": { "required": [ "memory_low_watermark" ] } } ] }, "shutdown": { "type": "object", "properties": { "drain_min": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s" }, "default": "5s" }, "drain_max": { "$ref": "#/$defs/Duration", "description": "≥ drain_min.", "default": "300s" }, "flush_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "10s" } }, "additionalProperties": false }, "probes": { "type": "object", "properties": { "readiness_requires": { "type": "array", "items": { "enum": [ "store", "counters" ] }, "uniqueItems": true, "default": [] }, "liveness_stall": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "10s" } }, "additionalProperties": false }, "upstream": { "type": "object", "properties": { "max_connections_per_host": { "type": "integer", "minimum": 1, "default": 1024 }, "max_idle_per_origin": { "type": "integer", "minimum": 0, "default": 256 }, "idle_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "55s" }, "max_connections_per_origin": { "type": "integer", "minimum": 1, "default": 64 }, "http2": { "enum": [ "auto", "prior_knowledge", "never" ], "default": "auto" }, "max_connection_age": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "15m" }, "tcp_keepalive": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "30s" }, "dns": { "type": "object", "properties": { "min_ttl": { "$ref": "#/$defs/Duration", "default": "5s" }, "max_ttl": { "$ref": "#/$defs/Duration", "default": "60s" }, "servers": { "type": "array", "items": { "type": "string", "pattern": "^[^\\s:]+:[0-9]{1,5}$|^\\[[0-9A-Fa-f:]+\\]:[0-9]{1,5}$" }, "minItems": 1, "description": "Resolvers as host:port; default: the system resolver." } }, "additionalProperties": false }, "happy_eyeballs_delay": { "$ref": "#/$defs/Duration", "default": "250ms" }, "prewarm_connections": { "type": "integer", "minimum": 0, "default": 0 } }, "additionalProperties": false } }, "additionalProperties": false }, "Store": { "type": "object", "description": "Top-level `store`, static.", "properties": { "backend": { "enum": [ "embedded", "postgres" ], "default": "embedded" }, "embedded": { "type": "object", "properties": { "path": { "type": "string", "minLength": 1, "default": "./antirion-data" } }, "additionalProperties": false }, "postgres": { "type": "object", "properties": { "url": { "$ref": "#/$defs/Secret" }, "pool_size": { "type": "integer", "minimum": 1, "maximum": 512, "default": 16 }, "connect_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "5s" }, "statement_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "5s" }, "migrate": { "enum": [ "auto", "manual" ], "default": "auto" }, "migrate_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "5m" } }, "additionalProperties": false }, "ledger": { "type": "object", "properties": { "flush_interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "100ms", "max": "60s" }, "default": "1s" } }, "additionalProperties": false }, "spool": { "type": "object", "properties": { "path": { "type": "string", "minLength": 1, "default": "./antirion-data/spool" }, "max_size": { "$ref": "#/$defs/Size", "x-range": { "gt": "0B" }, "default": "1GiB" }, "on_full": { "enum": [ "reject_budgeted", "drop" ], "default": "reject_budgeted" } }, "additionalProperties": false }, "logs": { "type": "object", "properties": { "backend": { "enum": [ "primary", "clickhouse" ], "default": "primary" }, "clickhouse": { "type": "object", "properties": { "url": { "$ref": "#/$defs/Secret" }, "database": { "type": "string", "minLength": 1, "default": "antirion" }, "batch_size": { "type": "integer", "minimum": 1, "maximum": 1000000, "default": 10000 }, "flush_interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "100ms", "max": "60s" }, "default": "1s" }, "insert_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "10s" } }, "additionalProperties": false } }, "additionalProperties": false, "allOf": [ { "if": { "properties": { "backend": { "const": "clickhouse" } }, "required": [ "backend" ] }, "then": { "required": [ "clickhouse" ], "properties": { "clickhouse": { "required": [ "url" ] } } } } ] } }, "additionalProperties": false, "allOf": [ { "if": { "properties": { "backend": { "const": "postgres" } }, "required": [ "backend" ] }, "then": { "required": [ "postgres" ], "properties": { "postgres": { "required": [ "url" ] } } } } ] }, "Cluster": { "type": "object", "description": "Top-level `cluster`, static.", "properties": { "mode": { "enum": [ "standalone", "cluster" ], "default": "standalone" }, "node_id": { "anyOf": [ { "type": "string", "pattern": "^[A-Za-z0-9._-]{1,64}$" }, { "type": "null" } ] }, "heartbeat_interval": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "2s" }, "node_ttl": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "description": "> 2 × heartbeat_interval.", "default": "10s" }, "probe_interval": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "1s" }, "config_sync": { "type": "object", "properties": { "poll_interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "250ms", "max": "2s" }, "default": "1s" } }, "additionalProperties": false }, "counters": { "type": "object", "properties": { "backend": { "enum": [ "memory", "redis" ], "default": "memory" }, "redis": { "type": "object", "properties": { "url": { "$ref": "#/$defs/Secret" }, "topology": { "enum": [ "standalone", "sentinel", "cluster" ], "default": "standalone" }, "sentinel": { "type": "object", "properties": { "master_name": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "null" } ] }, "urls": { "type": "array", "items": { "type": "string", "minLength": 1 } } }, "additionalProperties": false, "default": { "master_name": null, "urls": [] } }, "command_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "50ms" }, "key_prefix": { "type": "string", "default": "antirion:" }, "failure_detection": { "type": "object", "description": "When failed calls take the counter store out of use on a node: within the trailing window, at least min_failures calls failed and they are at least failure_rate of the calls. A failed call leaves its request's counters to on_store_unavailable either way; out of use, calls are no longer sent until three probes in a row pass.", "properties": { "window": { "$ref": "#/$defs/Duration", "x-range": { "min": "100ms", "max": "60s" }, "default": "1s" }, "failure_rate": { "type": "number", "exclusiveMinimum": 0, "maximum": 1, "default": 0.5 }, "min_failures": { "type": "integer", "minimum": 1, "maximum": 1000000, "default": 5 } }, "additionalProperties": false } }, "additionalProperties": false } }, "additionalProperties": false } }, "additionalProperties": false, "allOf": [ { "if": { "properties": { "mode": { "const": "cluster" } }, "required": [ "mode" ] }, "then": { "required": [ "counters" ], "properties": { "counters": { "required": [ "backend" ], "properties": { "backend": { "const": "redis" } } } } } } ] }, "Security": { "type": "object", "description": "Top-level `security`.", "properties": { "egress": { "type": "object", "properties": { "operator": { "type": "object", "properties": { "deny_private": { "type": "boolean", "default": false }, "allow_cidrs": { "type": "array", "items": { "$ref": "#/$defs/Cidr" }, "default": [] }, "allow_hosts": { "type": "array", "items": { "$ref": "#/$defs/HostPattern" }, "default": [] } }, "additionalProperties": false }, "client_influenced": { "type": "object", "properties": { "allowed_ports": { "type": "array", "items": { "type": "integer", "minimum": 1, "maximum": 65535 }, "uniqueItems": true, "default": [ 443 ] }, "allow_cidrs": { "type": "array", "items": { "$ref": "#/$defs/Cidr" }, "default": [] }, "allow_hosts": { "type": "array", "items": { "$ref": "#/$defs/HostPattern" }, "default": [] } }, "additionalProperties": false }, "metadata_hosts_extra": { "type": "array", "items": { "type": "string", "minLength": 1 }, "default": [] }, "proxy": { "anyOf": [ { "type": "object", "properties": { "url": { "$ref": "#/$defs/Url" }, "no_proxy": { "type": "array", "items": { "type": "string", "minLength": 1 } } }, "required": [ "url" ], "additionalProperties": false }, { "type": "null" } ], "default": null }, "tls": { "type": "object", "description": "Extra CA for every egress without its own tls block.", "properties": { "ca_file": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "null" } ], "default": null } }, "additionalProperties": false } }, "additionalProperties": false }, "limits": { "type": "object", "properties": { "max_body": { "$ref": "#/$defs/Size", "x-range": { "min": "1KiB" }, "default": "32MiB" }, "max_upload_body": { "$ref": "#/$defs/Size", "x-range": { "gt": "0B" }, "default": "512MiB" }, "max_json_depth": { "type": "integer", "minimum": 16, "maximum": 1024, "default": 128 }, "max_messages": { "type": "integer", "minimum": 1, "default": 100000 }, "max_header_bytes": { "$ref": "#/$defs/Size", "x-range": { "gt": "0B" }, "default": "64KiB" }, "max_header_count": { "type": "integer", "minimum": 1, "default": 200 }, "max_uri_length": { "type": "integer", "minimum": 1, "default": 16384 }, "max_upstream_response": { "$ref": "#/$defs/Size", "x-range": { "gt": "0B" }, "default": "128MiB" } }, "additionalProperties": false }, "media_fetch": { "type": "object", "properties": { "max_bytes": { "$ref": "#/$defs/Size", "x-range": { "gt": "0B" }, "default": "20MiB" }, "connect_timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "5s" }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "30s" }, "allowed_types": { "type": "object", "propertyNames": { "enum": [ "image", "document", "audio" ] }, "additionalProperties": { "type": "array", "items": { "type": "string", "pattern": "^[a-z]+/([a-z0-9.+-]+|\\*)$" }, "uniqueItems": true }, "default": { "image": [ "image/png", "image/jpeg", "image/gif", "image/webp" ], "document": [ "application/pdf" ], "audio": [ "audio/*" ] } } }, "additionalProperties": false }, "client_ip": { "type": "object", "properties": { "trusted_proxies": { "type": "array", "items": { "$ref": "#/$defs/Cidr" }, "default": [] }, "header": { "$ref": "#/$defs/HeaderName", "description": "x-forwarded-for | forwarded | any single-IP header name.", "default": "x-forwarded-for" } }, "additionalProperties": false }, "tls": { "type": "object", "properties": { "listeners": { "type": "object", "description": "Absent = plaintext listener.", "properties": { "data": { "$ref": "#/$defs/TlsListener" }, "admin": { "$ref": "#/$defs/TlsListener" } }, "additionalProperties": false }, "reload_interval": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "10s" } }, "additionalProperties": false }, "secrets": { "type": "object", "properties": { "encryption_keys": { "type": "array", "description": "Base64 of 32 bytes; the first encrypts.", "items": { "$ref": "#/$defs/Base64Key32" }, "minItems": 1 }, "stores": { "type": "object", "description": "External secret stores, one per kind.", "properties": { "vault": { "$ref": "#/$defs/VaultStore" }, "aws_sm": { "$ref": "#/$defs/AwsSecretsManagerStore" }, "gcp_sm": { "$ref": "#/$defs/GcpSecretManagerStore" }, "azure_kv": { "$ref": "#/$defs/AzureKeyVaultStore" } }, "additionalProperties": false, "default": {} } }, "additionalProperties": false }, "cors": { "type": "object", "properties": { "data": { "$ref": "#/$defs/CorsListener" }, "admin": { "$ref": "#/$defs/CorsListener" } }, "additionalProperties": false }, "hsts": { "type": "object", "properties": { "enabled": { "type": "boolean", "default": false }, "max_age": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "365d" }, "include_subdomains": { "type": "boolean", "default": false } }, "additionalProperties": false } }, "additionalProperties": false }, "Breaker": { "type": "object", "description": "Deployment circuit breaker.", "properties": { "enabled": { "type": "boolean", "default": true }, "consecutive_failures": { "anyOf": [ { "type": "integer", "minimum": 1, "maximum": 1000 }, { "const": "none" } ], "default": 5 }, "failure_rate": { "type": "number", "exclusiveMinimum": 0, "maximum": 1, "default": 0.5 }, "min_requests": { "type": "integer", "minimum": 1, "default": 20 }, "window": { "$ref": "#/$defs/Duration", "x-range": { "min": "100ms" }, "default": "60s" }, "buckets": { "type": "integer", "minimum": 1, "maximum": 60, "default": 10 }, "open_duration": { "$ref": "#/$defs/Duration", "x-range": { "min": "1ms" }, "default": "30s" }, "max_open_duration": { "$ref": "#/$defs/Duration", "description": "≥ open_duration.", "default": "300s" }, "half_open_probes": { "type": "integer", "minimum": 1, "maximum": 100, "default": 1 }, "success_threshold": { "type": "integer", "minimum": 1, "maximum": 100, "default": 1 }, "probe_scope": { "enum": [ "node", "cluster" ], "description": "`cluster` counts `half_open_probes` across the cluster's nodes through leases in the shared counter store; `node` counts them per node.", "default": "node" } }, "additionalProperties": false }, "Metadata": { "type": "object", "maxProperties": 32, "propertyNames": { "type": "string", "minLength": 1, "maxLength": 64 }, "additionalProperties": { "type": "string", "maxLength": 512 }, "description": "Free-form string → string map, ≤ 32 entries, keys ≤ 64, values ≤ 512." }, "EndpointToggle": { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "additionalProperties": false, "description": "An endpoint's settings: `enabled` (default true for endpoints)." }, "AuthThrottle": { "type": "object", "properties": { "max_failures": { "type": "integer", "minimum": 1 }, "window": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" }, "default": "1m" } }, "additionalProperties": false }, "CorsListener": { "type": "object", "properties": { "allowed_origins": { "type": "array", "items": { "type": "string", "pattern": "^(\\*|[A-Za-z][A-Za-z0-9+.-]*://(\\*\\.)?[^/\\s*]+)$" }, "default": [] }, "allowed_methods": { "type": "array", "items": { "$ref": "#/$defs/HttpMethod" }, "uniqueItems": true, "default": [ "GET", "POST", "DELETE", "OPTIONS" ] }, "allow_headers": { "anyOf": [ { "const": "reflect" }, { "type": "array", "items": { "$ref": "#/$defs/HeaderName" } } ], "default": "reflect" }, "expose_headers": { "type": "array", "items": { "anyOf": [ { "$ref": "#/$defs/HeaderName" }, { "const": "*" } ] }, "default": [ "*" ] }, "max_age": { "$ref": "#/$defs/Duration", "default": "10m" }, "allow_credentials": { "type": "boolean", "description": "true with \"*\" is a config error.", "default": false } }, "additionalProperties": false, "allOf": [ { "if": { "properties": { "allow_credentials": { "const": true } }, "required": [ "allow_credentials" ] }, "then": { "properties": { "allowed_origins": { "not": { "contains": { "const": "*" } } } } } } ] }, "TlsListener": { "type": "object", "description": "Listener TLS; absent = plaintext.", "properties": { "cert_file": { "type": "string", "minLength": 1 }, "key_file": { "type": "string", "minLength": 1 }, "min_version": { "enum": [ "1.2", "1.3" ], "default": "1.2" }, "alpn": { "type": "array", "items": { "enum": [ "h2", "http/1.1" ] }, "uniqueItems": true, "default": [ "h2", "http/1.1" ] }, "client_auth": { "enum": [ "none", "optional", "required" ], "default": "none" }, "client_ca_file": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "null" } ], "default": null } }, "additionalProperties": false, "dependentRequired": { "cert_file": [ "key_file" ], "key_file": [ "cert_file" ] } }, "LatencyEstimate": { "type": "object", "properties": { "ttft": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } }, "per_token": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } }, "e2e": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } } }, "additionalProperties": false }, "ForwardPattern": { "type": "string", "pattern": "^[!#$%&'+.^_`|~0-9A-Za-z-]*\\*?$", "minLength": 1, "not": { "$ref": "#/$defs/AlwaysDenyHeader" } }, "ProviderAuthFields_api_key": { "description": "The `auth` fields allowed with method `api_key`; every other method's fields are rejected.", "allOf": [ { "properties": { "access_key_id": false, "assume_role": false, "authority_host": false, "client_id": false, "client_secret": false, "managed_identity": false, "scope": false, "scopes": false, "secret_access_key": false, "service_account_json": false, "session_token": false, "tenant_id": false, "token_file": false } }, { "oneOf": [ { "required": [ "api_key" ] }, { "required": [ "api_keys" ] } ] } ] }, "ProviderAuthFields_aws_sigv4": { "description": "The `auth` fields allowed with method `aws_sigv4`; every other method's fields are rejected.", "properties": { "api_key": false, "api_keys": false, "authority_host": false, "client_id": false, "client_secret": false, "header": false, "managed_identity": false, "prefix": false, "scope": false, "scopes": false, "service_account_json": false, "tenant_id": false, "token_file": false } }, "ProviderAuthFields_gcp": { "description": "The `auth` fields allowed with method `gcp`; every other method's fields are rejected.", "properties": { "access_key_id": false, "api_key": false, "api_keys": false, "assume_role": false, "authority_host": false, "client_id": false, "client_secret": false, "header": false, "managed_identity": false, "prefix": false, "scope": false, "secret_access_key": false, "session_token": false, "tenant_id": false, "token_file": false } }, "ProviderAuthFields_azure_ad": { "description": "The `auth` fields allowed with method `azure_ad`; every other method's fields are rejected.", "properties": { "access_key_id": false, "api_key": false, "api_keys": false, "assume_role": false, "header": false, "prefix": false, "scopes": false, "secret_access_key": false, "service_account_json": false, "session_token": false } }, "ProviderAuthFields_none": { "description": "The `auth` fields allowed with method `none`; every other method's fields are rejected.", "properties": { "access_key_id": false, "api_key": false, "api_keys": false, "assume_role": false, "authority_host": false, "client_id": false, "client_secret": false, "header": false, "managed_identity": false, "prefix": false, "scope": false, "scopes": false, "secret_access_key": false, "service_account_json": false, "session_token": false, "tenant_id": false, "token_file": false } }, "DeniedUrlHost": { "description": "A cloud-metadata host name or an always-denied IP literal as the URL's host.", "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://([Mm][Ee][Tt][Aa][Dd][Aa][Tt][Aa]|[Mm][Ee][Tt][Aa][Dd][Aa][Tt][Aa]\\.[Gg][Oo][Oo][Gg][Ll][Ee]\\.[Ii][Nn][Tt][Ee][Rr][Nn][Aa][Ll]|[Mm][Ee][Tt][Aa][Dd][Aa][Tt][Aa]\\.[Gg][Oo][Oo][Gg]|[Ii][Nn][Ss][Tt][Aa][Nn][Cc][Ee]-[Dd][Aa][Tt][Aa]|[Ii][Nn][Ss][Tt][Aa][Nn][Cc][Ee]-[Dd][Aa][Tt][Aa]\\.[Ee][Cc]2\\.[Ii][Nn][Tt][Ee][Rr][Nn][Aa][Ll]|[Mm][Ee][Tt][Aa][Dd][Aa][Tt][Aa]\\.[Aa][Mm][Aa][Zz][Oo][Nn][Aa][Ww][Ss]\\.[Cc][Oo][Mm]|0\\.[0-9.]+|169\\.254\\.[0-9.]+|100\\.100\\.100\\.200|168\\.63\\.129\\.16|2(2[4-9]|[3-5][0-9])\\.[0-9.]+|\\[([Ff][Ee][89ABab][0-9A-Fa-f]?:[^\\]]*|[Ff][Dd]00:[Ee][Cc]2::254|[Ff][Dd]20:[Cc][Ee]::254|::|[Ff][Ff][0-9A-Fa-f]{2}:[^\\]]*)\\])\\.?([:/?#]|$)" }, "NonCanonicalNumericHost": { "description": "A host made only of digits and dots that is not a canonical dotted-quad IPv4 address (`127.1`, `1.2.3.4.5`, `2130706433`), or a first label in hex (`0x7f`), is rejected.", "anyOf": [ { "allOf": [ { "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://[0-9.]+([:/?#]|$)" }, { "not": { "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}([:/?#]|$)" } } ] }, { "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://0[Xx][0-9A-Fa-f]+([.:/?#]|$)" } ] }, "AlwaysDenyHeader": { "description": "A header name on 's always-deny list (hop-by-hop, framing, credential and gateway-owned headers), compared case-insensitively.", "pattern": "^([Cc][Oo][Nn][Nn][Ee][Cc][Tt][Ii][Oo][Nn]|[Kk][Ee][Ee][Pp]-[Aa][Ll][Ii][Vv][Ee]|[Pp][Rr][Oo][Xx][Yy]-[Cc][Oo][Nn][Nn][Ee][Cc][Tt][Ii][Oo][Nn]|[Tt][Ee]|[Tt][Rr][Aa][Ii][Ll][Ee][Rr]|[Tt][Rr][Aa][Nn][Ss][Ff][Ee][Rr]-[Ee][Nn][Cc][Oo][Dd][Ii][Nn][Gg]|[Uu][Pp][Gg][Rr][Aa][Dd][Ee]|[Hh][Oo][Ss][Tt]|[Cc][Oo][Nn][Tt][Ee][Nn][Tt]-[Ll][Ee][Nn][Gg][Tt][Hh]|[Ee][Xx][Pp][Ee][Cc][Tt]|[Cc][Oo][Nn][Tt][Ee][Nn][Tt]-[Ee][Nn][Cc][Oo][Dd][Ii][Nn][Gg]|[Aa][Cc][Cc][Ee][Pp][Tt]-[Ee][Nn][Cc][Oo][Dd][Ii][Nn][Gg]|[Aa][Uu][Tt][Hh][Oo][Rr][Ii][Zz][Aa][Tt][Ii][Oo][Nn]|[Pp][Rr][Oo][Xx][Yy]-[Aa][Uu][Tt][Hh][Oo][Rr][Ii][Zz][Aa][Tt][Ii][Oo][Nn]|[Xx]-[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Xx]-[Gg][Oo][Oo][Gg]-[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Oo][Cc][Pp]-[Aa][Pp][Ii][Mm]-[Ss][Uu][Bb][Ss][Cc][Rr][Ii][Pp][Tt][Ii][Oo][Nn]-[Kk][Ee][Yy]|[Cc][Oo][Oo][Kk][Ii][Ee]|[Xx]-[Gg][Oo][Oo][Gg]-[Uu][Ss][Ee][Rr]-[Pp][Rr][Oo][Jj][Ee][Cc][Tt]|[Oo][Pp][Ee][Nn][Aa][Ii]-[Oo][Rr][Gg][Aa][Nn][Ii][Zz][Aa][Tt][Ii][Oo][Nn]|[Oo][Pp][Ee][Nn][Aa][Ii]-[Pp][Rr][Oo][Jj][Ee][Cc][Tt]|[Xx]-[Ll][Ii][Tt][Ee][Ll][Ll][Mm]-[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Xx]-[Pp][Oo][Rr][Tt][Kk][Ee][Yy]-[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Xx]-[Pp][Oo][Rr][Tt][Kk][Ee][Yy]-[Vv][Ii][Rr][Tt][Uu][Aa][Ll]-[Kk][Ee][Yy]|[Hh][Ee][Ll][Ii][Cc][Oo][Nn][Ee]-[Aa][Uu][Tt][Hh]|[Hh][Ee][Ll][Ii][Cc][Oo][Nn][Ee]-[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Xx]-[Bb][Ff]-[Vv][Kk]|[Xx]-[Bb][Ff]-[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Xx]-[Bb][Ff]-[Aa][Pp][Ii]-[Kk][Ee][Yy]-[Ii][Dd]|[Xx]-[Mm][Ll][Ff][Ll][Oo][Ww]-[Aa][Uu][Tt][Hh][Oo][Rr][Ii][Zz][Aa][Tt][Ii][Oo][Nn]|[Ff][Oo][Rr][Ww][Aa][Rr][Dd][Ee][Dd]|[Xx]-[Rr][Ee][Aa][Ll]-[Ii][Pp]|[Tt][Rr][Uu][Ee]-[Cc][Ll][Ii][Ee][Nn][Tt]-[Ii][Pp]|[Cc][Ff]-[Cc][Oo][Nn][Nn][Ee][Cc][Tt][Ii][Nn][Gg]-[Ii][Pp]|[Xx]-[Cc][Ll][Ii][Ee][Nn][Tt]-[Ii][Pp]|[Cc][Ll][Ii][Ee][Nn][Tt]-[Cc][Ee][Rr][Tt]|[Cc][Ll][Ii][Ee][Nn][Tt]-[Cc][Ee][Rr][Tt]-[Cc][Hh][Aa][Ii][Nn])$|^([Xx]-[Aa][Mm][Zz]-|[Xx]-[Aa][Nn][Tt][Ii][Rr][Ii][Oo][Nn]-|[Xx]-[Ff][Oo][Rr][Ww][Aa][Rr][Dd][Ee][Dd]-)" }, "Region": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,62}$", "description": "A provider region or location name." }, "Tier": { "type": "string", "description": "A built-in tier (frontier, balanced, fast, specialized) or one declared in routing.tiers.", "pattern": "^[a-z][a-z0-9_-]{0,31}$" }, "IpSetRef": { "type": "string", "description": "A named IP set of auth.ip_sets.", "pattern": "^set:[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }, "Severity": { "enum": [ "critical", "high", "medium", "low" ], "description": "Safety severity." }, "KeyPolicy": { "type": "object", "description": "Key lifetime and rotation policy at a tenancy level; the narrowest level that sets a field wins.", "properties": { "default_lifetime": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } }, "rotation_max_age": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s" } }, "reminder_days": { "type": "array", "items": { "type": "integer", "minimum": 1, "maximum": 365 }, "uniqueItems": true, "maxItems": 8, "default": [ 14, 7, 3, 1 ] }, "default_grace_period": { "$ref": "#/$defs/Duration", "x-range": { "min": "0s", "max": "7d" }, "description": "Bounded by the 7d maximum grace of a rotation." } }, "additionalProperties": false }, "Smtp": { "type": "object", "description": "Top-level `smtp`, dynamic: outgoing email for password resets, invitations, email alert channels and personal notifications.", "properties": { "enabled": { "type": "boolean", "default": false }, "host": { "type": "string", "minLength": 1, "maxLength": 253 }, "port": { "type": "integer", "minimum": 1, "maximum": 65535, "default": 587 }, "tls": { "enum": [ "starttls", "tls", "none" ], "description": "none is accepted only for a loopback host.", "default": "starttls" }, "username": { "type": "string", "minLength": 1, "maxLength": 256 }, "password": { "$ref": "#/$defs/Secret" }, "from": { "type": "string", "minLength": 3, "maxLength": 320 }, "reply_to": { "type": "string", "minLength": 3, "maxLength": 320 }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s", "max": "2m" }, "default": "10s" }, "max_messages_per_minute": { "type": "integer", "minimum": 1, "maximum": 10000, "default": 60 } }, "additionalProperties": false, "if": { "properties": { "enabled": { "const": true } }, "required": [ "enabled" ] }, "then": { "required": [ "host", "from" ] } }, "Governance": { "type": "object", "description": "Top-level `governance`, dynamic.", "properties": { "change_control": { "type": "object", "properties": { "resources": { "type": "array", "items": { "enum": [ "providers", "deployments", "models", "routes", "guardrails", "plugins", "pricing", "policies", "organizations", "teams", "projects", "keys", "users", "settings" ] }, "uniqueItems": true, "default": [] }, "protected_paths": { "type": "array", "items": { "type": "object", "properties": { "path": { "type": "string", "minLength": 1, "maxLength": 512 }, "above": { "type": "string", "minLength": 1, "maxLength": 64 } }, "required": [ "path" ], "additionalProperties": false }, "default": [] }, "approvals_required": { "type": "integer", "minimum": 1, "maximum": 5, "default": 1 }, "request_ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "1h", "max": "90d" }, "default": "7d" } }, "additionalProperties": false }, "dual_control": { "type": "object", "properties": { "actions": { "type": "array", "items": { "enum": [ "cache_flush_all", "ingress_pause", "organization_delete", "secrets_rotate", "budget_reset", "audit_sink_delete" ] }, "uniqueItems": true, "default": [] }, "approval_ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "5m", "max": "24h" }, "default": "1h" } }, "additionalProperties": false }, "audit_sinks": { "type": "object", "propertyNames": { "$ref": "#/$defs/Name" }, "additionalProperties": { "type": "object", "properties": { "type": { "enum": [ "http" ], "default": "http" }, "enabled": { "type": "boolean", "default": true }, "url": { "$ref": "#/$defs/HttpsUrl" }, "headers": { "$ref": "#/$defs/HeaderValues", "default": {} }, "format": { "enum": [ "ndjson", "json_array" ], "default": "ndjson" }, "batch_max_records": { "type": "integer", "minimum": 1, "maximum": 10000, "default": 500 }, "flush_interval": { "$ref": "#/$defs/Duration", "x-range": { "min": "10ms", "max": "60s" }, "default": "5s" }, "max_retry_duration": { "$ref": "#/$defs/Duration", "x-range": { "min": "1m", "max": "30d" }, "default": "72h" } }, "required": [ "url" ], "additionalProperties": false }, "default": {} }, "maintenance_windows": { "type": "array", "description": "Informational windows; each one ends after it starts.", "items": { "type": "object", "properties": { "start": { "$ref": "#/$defs/RfcTime" }, "end": { "$ref": "#/$defs/RfcTime" }, "description": { "type": "string", "maxLength": 500 } }, "required": [ "start", "end" ], "additionalProperties": false }, "maxItems": 50, "default": [] } }, "additionalProperties": false }, "Node_tier": { "type": "object", "description": "A `tier` node.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] }, "id": { "$ref": "#/$defs/NodeId" }, "params": { "$ref": "#/$defs/NodeParams", "default": {} }, "policies": { "$ref": "#/$defs/PoliciesNode", "default": {} }, "mirror": { "$ref": "#/$defs/Mirror" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 }, "tier": { "$ref": "#/$defs/Tier" }, "strategy": { "enum": [ "least_cost", "least_latency", "weighted", "fallback" ], "default": "least_cost" }, "include_preview": { "type": "boolean", "default": false } }, "required": [ "tier" ], "additionalProperties": false }, "Node_block": { "type": "object", "description": "A `block` node.", "properties": { "type": { "enum": [ "deployment", "provider_model", "route", "fallback", "weighted", "least_latency", "least_busy", "least_cost", "conditional", "classifier", "cost_quality", "pool", "tier", "block" ] }, "id": { "$ref": "#/$defs/NodeId" }, "weight": { "$ref": "#/$defs/Weight", "default": 1 }, "status": { "enum": [ 400, 403, 451 ], "default": 400 }, "message": { "type": "string", "minLength": 1, "maxLength": 1000, "default": "Request blocked by routing policy." }, "category": { "enum": [ "deny_pattern", "allow_pattern", "keyword", "pii", "secret", "hate", "harassment", "violence", "sexual", "self_harm", "illicit", "prompt_injection", "off_topic", "invalid_json", "schema_violation", "tool_not_allowed", "length", "uninspectable", "custom" ], "default": "custom" } }, "additionalProperties": false }, "Catalog": { "type": "object", "description": "The runtime catalog. `extend` lays its entries over the bundled catalog (an entry replaces a bundled entry of the same pattern); `replace` uses its entries alone. Below both, models.dev's data prices the models nothing else prices (not with `replace`).", "properties": { "mode": { "enum": [ "extend", "replace" ], "default": "extend" }, "version": { "anyOf": [ { "type": "string", "minLength": 1, "maxLength": 100 }, { "type": "null" } ], "default": null, "description": "The operator's label for this catalog." }, "models": { "type": "object", "description": "Pattern → entry. A pattern is `/` or ``; a trailing `*` matches by prefix (longest wins).", "propertyNames": { "type": "string", "pattern": "^[A-Za-z0-9._:/@+-]{1,255}\\*?$" }, "additionalProperties": { "$ref": "#/$defs/CatalogEntry" }, "maxProperties": 10000, "default": {} }, "remote": { "type": "object", "description": "Fetches models.dev's model data (prices, limits, names) periodically, through the egress policy, in place of the snapshot bundled with the gateway. On by default; off by default in test mode. A fetch that fails keeps the data in use; the bundled prices and `models` still come first wherever they define a model.", "properties": { "enabled": { "type": "boolean", "default": true }, "url": { "type": "string", "format": "uri", "pattern": "^https?://[^\\s]+$", "maxLength": 2048, "default": "https://models.dev/api.json", "description": "A document in models.dev's `api.json` shape." }, "refresh": { "$ref": "#/$defs/Duration", "x-range": { "min": "1h", "max": "30d" }, "default": "24h", "description": "How often the document is fetched." } }, "additionalProperties": false } }, "additionalProperties": false }, "CatalogEntry": { "type": "object", "description": ": capability values (the catalog layer of), the time-to-first-token hint and the catalog price of one pattern.", "properties": { "capabilities": { "$ref": "#/$defs/Capabilities" }, "ttft": { "$ref": "#/$defs/Duration", "x-range": { "min": "1s", "max": "1h" } }, "price": { "$ref": "#/$defs/Price" } }, "additionalProperties": false }, "VaultStore": { "type": "object", "description": "HashiCorp Vault: `${vault:#}` reads `GET

/v1/` and takes `field` of a KV version 2 secret's `data.data`, else of `data`.", "properties": { "address": { "$ref": "#/$defs/Url", "description": "The Vault server, e.g. https://vault.internal:8200; operator egress." }, "namespace": { "anyOf": [ { "type": "string", "minLength": 1, "maxLength": 256 }, { "type": "null" } ], "default": null, "description": "Sent as X-Vault-Namespace." }, "auth": { "type": "object", "properties": { "method": { "enum": [ "token", "approle", "kubernetes" ], "default": "token" }, "token": { "$ref": "#/$defs/Secret", "description": "method token: the Vault token." }, "role_id": { "type": "string", "minLength": 1, "maxLength": 256, "description": "method approle." }, "secret_id": { "$ref": "#/$defs/Secret", "description": "method approle." }, "role": { "type": "string", "minLength": 1, "maxLength": 256, "description": "method kubernetes: the Vault role." }, "jwt_file": { "type": "string", "minLength": 1, "default": "/var/run/secrets/kubernetes.io/serviceaccount/token", "description": "method kubernetes: the service account token file, read at each login." }, "mount": { "anyOf": [ { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_./-]{0,127}$" }, { "type": "null" } ], "default": null, "description": "The auth method's mount path; null = the method's name." } }, "additionalProperties": false }, "ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "1s", "max": "24h" }, "default": "5m", "description": "The longest a resolved value is used before it is fetched again." }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s", "max": "60s" }, "default": "5s" } }, "required": [ "address", "auth" ], "additionalProperties": false }, "AwsSecretsManagerStore": { "type": "object", "description": "AWS Secrets Manager: `${aws-sm:[#]}` is `GetSecretValue`; with a field, the secret string is a JSON object and the field's value is used.", "properties": { "region": { "anyOf": [ { "type": "string", "pattern": "^[a-z0-9-]{1,32}$" }, { "type": "null" } ], "default": null, "description": "The region of references that are not ARNs; an ARN names its own." }, "endpoint": { "anyOf": [ { "$ref": "#/$defs/Url" }, { "type": "null" } ], "default": null, "description": "Null = https://secretsmanager..amazonaws.com." }, "access_key_id": { "$ref": "#/$defs/Secret", "description": "With secret_access_key; absent = the default credential chain." }, "secret_access_key": { "$ref": "#/$defs/Secret" }, "session_token": { "$ref": "#/$defs/Secret" }, "assume_role": { "type": "object", "description": "A role assumed with the base credentials.", "properties": { "role_arn": { "type": "string", "pattern": "^arn:" }, "external_id": { "type": "string" }, "session_name": { "type": "string", "minLength": 1, "default": "antirion" }, "duration": { "$ref": "#/$defs/Duration", "x-range": { "min": "15m", "max": "12h" }, "default": "1h" }, "sts_endpoint": { "type": [ "string", "null" ], "format": "uri", "default": null, "description": "Optional STS endpoint URL; default: the regional AWS STS endpoint." } }, "required": [ "role_arn" ], "additionalProperties": false }, "ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "1s", "max": "24h" }, "default": "5m", "description": "The longest a resolved value is used before it is fetched again." }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s", "max": "60s" }, "default": "5s" } }, "additionalProperties": false }, "GcpSecretManagerStore": { "type": "object", "description": "Google Cloud Secret Manager: `${gcp-sm:projects/

/secrets/[/versions/]}` is the version's `:access` (default version `latest`).", "properties": { "service_account_json": { "$ref": "#/$defs/Secret", "description": "Secret reference or literal JSON; absent = ADC." }, "endpoint": { "$ref": "#/$defs/Url", "default": "https://secretmanager.googleapis.com" }, "ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "1s", "max": "24h" }, "default": "5m", "description": "The longest a resolved value is used before it is fetched again." }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s", "max": "60s" }, "default": "5s" } }, "additionalProperties": false }, "AzureKeyVaultStore": { "type": "object", "description": "Azure Key Vault: `${azure-kv:/[/]}` reads the secret from https://..", "properties": { "tenant_id": { "type": "string", "minLength": 1 }, "client_id": { "type": "string", "minLength": 1 }, "client_secret": { "$ref": "#/$defs/Secret" }, "managed_identity": { "type": "boolean", "default": false }, "authority_host": { "$ref": "#/$defs/Url", "default": "https://login.microsoftonline.com" }, "token_file": { "type": "string", "minLength": 1, "description": "Workload identity: the federated token file; used without client_secret and managed_identity." }, "vault_suffix": { "type": "string", "pattern": "^[a-z0-9.-]{1,128}$", "default": "vault.azure.net" }, "endpoint": { "anyOf": [ { "$ref": "#/$defs/Url" }, { "type": "null" } ], "default": null, "description": "A proxy or emulator base URL: requests go to //secrets/… instead of https://./secrets/…." }, "ttl": { "$ref": "#/$defs/Duration", "x-range": { "min": "1s", "max": "24h" }, "default": "5m", "description": "The longest a resolved value is used before it is fetched again." }, "timeout": { "$ref": "#/$defs/Duration", "x-range": { "gt": "0s", "max": "60s" }, "default": "5s" } }, "additionalProperties": false } } }