For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.
Configuration schema explorer
Explore the agentgateway standalone configuration schema interactively, including nested fields and validation details.
Generated from the agentgateway JSON schema.
- config
- enableIpv6boolean
- dns
- lookupFamilystring
- edns0boolean
- localXdsPathstring
- modelCatalog
- *filestring
- caAddressstring
- caAuthTokenstring
- xdsAddressstring
- xdsAuthTokenstring
- namespacestring
- gatewaystring
- trustDomainstring
- additionalTrustDomainsstring
- skipValidateTrustDomainboolean
- serviceAccountstring
- clusterIdstring
- networkstring
- adminAddrstring
- statsAddrstring
- readinessAddrstring
- session
- *keystring
- mcp
- sessionTtlstring
- connectionTerminationDeadlinestring
- connectionMinTerminationDeadlinestring
- workerThreadsstring
- tracing
- otlpEndpointstring
- headersobject
- otlpProtocolstring
- fields
- removestring[]
- addobject
- randomSamplingstring|number|boolean
- clientSamplingstring|number|boolean
- pathstring
- logging
- filterstring
- fields
- removestring[]
- addobject
- levelstring[]
- formatstring
- metrics
- removestring[]
- fields
- addobject
- backend
- keepalives
- enabledboolean
- timestring
- intervalstring
- retriesinteger
- connectTimeoutstring
- poolIdleTimeoutstring
- poolMaxSizeinteger
- hbone
- windowSizeinteger
- connectionWindowSizeinteger
- frameSizeinteger
- poolMaxStreamsPerConninteger
- poolUnusedReleaseTimeoutstring
- frontendPolicies
- http
- maxBufferSizeinteger
- http1MaxHeadersinteger
- http1IdleTimeoutstring
- http1HeaderCasestring
- http2WindowSizeinteger
- http2ConnectionWindowSizeinteger
- http2FrameSizeinteger
- http2MaxHeaderSizeinteger
- http2KeepaliveIntervalstring
- http2KeepaliveTimeoutstring
- maxConnectionDurationstring
- tls
- handshakeTimeoutstring
- alpnarray[]
- minVersionstring
- maxVersionstring
- cipherSuitesstring[]
- keyExchangeGroupsstring[]
- tcp
- *keepalives
- enabledboolean
- timestring
- intervalstring
- retriesinteger
- networkAuthorization
- *rules
- *allowstring
- proxy
- versionstring
- modestring
- proxyProtocol
- versionstring
- modestring
- connect
- *modestring
- accessLog
- filterstring
- addobject
- removestring[]
- otlp
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- logging
- filterstring
- addobject
- removestring[]
- otlp
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- tracing
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- binds
- *portinteger
- *listeners
- namestring
- namespacestring
- hostnamestring
- protocolstring
- tls
- modestring
- *certstring
- *keystring
- rootstring
- cipherSuitesstring[]
- minTLSVersionstring
- minTlsVersionstring
- maxTLSVersionstring
- maxTlsVersionstring
- keyExchangeGroupsstring[]
- routes
- namestring
- namespacestring
- ruleNamestring
- hostnamesstring[]
- matches
- headers
- *namestring
- *value
- *exactstring
- path
- *exactstring
- methodstring
- query
- *namestring
- *value
- *exactstring
- policies
- requestHeaderModifier
- addobject
- setobject
- removestring[]
- responseHeaderModifier
- addobject
- setobject
- removestring[]
- requestRedirect
- schemestring
- authority
- *fullstring
- path
- *fullstring
- statusinteger
- urlRewrite
- authority
- *fullstring
- path
- *fullstring
- requestMirror
- *backend
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- *percentagenumber
- directResponse
- *conditional
- conditionstring
- bodyarray|string
- bodyExpressionstring
- headersobject
- *statusinteger
- cors
- allowCredentialsboolean
- allowHeadersstring[]
- allowMethodsstring[]
- allowOriginsstring[]
- exposeHeadersstring[]
- maxAgestring
- mcpAuthorization
- *rules
- *allowstring
- mcpGuardrails
- *processors
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- authorization
- *rules
- *allowstring
- mcpAuthentication
- *issuerstring
- *audiencesstring[]
- provider
- *auth0object
- *resourceMetadataobject
- *jwks
- *filestring
- modestring
- authorizationLocation
- *header
- *namestring
- prefixstring
- jwtValidationOptions
- requiredClaimsstring[]
- clientIdstring
- a2aobject
- ai
- promptGuard
- streamingstring
- request
- *regex
- actionstring
- *rules
- *builtinstring
- response
- *regex
- actionstring
- *rules
- *builtinstring
- defaultsobject
- overridesobject
- transformationsobject
- prompts
- append
- *rolestring
- *contentstring
- prepend
- *rolestring
- *contentstring
- modelAliasesobject
- promptCaching
- cacheSystemboolean
- cacheMessagesboolean
- cacheToolsboolean
- minTokensinteger
- cacheMessageOffsetinteger
- routesobject
- backendTLS
- certstring
- keystring
- rootstring
- hostnamestring
- insecureboolean
- insecureHostboolean
- alpnstring[]
- subjectAltNamesstring[]
- keyExchangeGroupsstring[]
- backendTunnel
- *proxy
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- backendAuth
- *passthrough
- location
- *header
- *namestring
- prefixstring
- localRateLimit
- *conditional
- conditionstring
- maxTokensinteger
- tokensPerFillinteger
- *fillIntervalstring
- typestring
- remoteRateLimit
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- jwtAuth
- modestring
- location
- *header
- *namestring
- prefixstring
- *providers
- *issuerstring
- audiencesstring[]
- *jwks
- *filestring
- jwtValidationOptions
- requiredClaimsstring[]
- oidc
- *issuerstring
- discovery
- *filestring
- authorizationEndpointstring
- tokenEndpointstring
- tokenEndpointAuthstring
- jwks
- *filestring
- *clientIdstring
- *clientSecretstring
- *redirectURIstring
- scopesstring[]
- basicAuth
- *htpasswd
- *filestring
- realmstring
- modestring
- authorizationLocation
- *header
- *namestring
- prefixstring
- apiKey
- *keys
- *keystring
- metadata
- modestring
- location
- *header
- *namestring
- prefixstring
- extAuthz
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- extProc
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- transformations
- *conditional
- conditionstring
- request
- addobject
- setobject
- removestring[]
- bodystring
- metadataobject
- response
- addobject
- setobject
- removestring[]
- bodystring
- metadataobject
- csrf
- additionalOriginsstring[]
- buffer
- request
- maxBytesinteger
- response
- maxBytesinteger
- timeout
- requestTimeoutstring
- backendRequestTimeoutstring
- retry
- attemptsinteger
- backoffstring
- *codesinteger[]
- preconditionstring
- conditionstring
- backends
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- tcpRoutes
- namestring
- namespacestring
- ruleNamestring
- hostnamesstring[]
- policies
- backendTLS
- certstring
- keystring
- rootstring
- hostnamestring
- insecureboolean
- insecureHostboolean
- alpnstring[]
- subjectAltNamesstring[]
- keyExchangeGroupsstring[]
- backends
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- policies
- oidc
- *issuerstring
- discovery
- *filestring
- authorizationEndpointstring
- tokenEndpointstring
- tokenEndpointAuthstring
- jwks
- *filestring
- *clientIdstring
- *clientSecretstring
- *redirectURIstring
- scopesstring[]
- jwtAuth
- modestring
- location
- *header
- *namestring
- prefixstring
- *providers
- *issuerstring
- audiencesstring[]
- *jwks
- *filestring
- jwtValidationOptions
- requiredClaimsstring[]
- authorization
- *rules
- *allowstring
- extAuthz
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- extProc
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- cors
- allowCredentialsboolean
- allowHeadersstring[]
- allowMethodsstring[]
- allowOriginsstring[]
- exposeHeadersstring[]
- maxAgestring
- transformations
- *conditional
- conditionstring
- request
- addobject
- setobject
- removestring[]
- bodystring
- metadataobject
- response
- addobject
- setobject
- removestring[]
- bodystring
- metadataobject
- basicAuth
- *htpasswd
- *filestring
- realmstring
- modestring
- authorizationLocation
- *header
- *namestring
- prefixstring
- apiKey
- *keys
- *keystring
- metadata
- modestring
- location
- *header
- *namestring
- prefixstring
- tunnelProtocolstring
- llm
- portinteger
- tls
- modestring
- *certstring
- *keystring
- rootstring
- cipherSuitesstring[]
- minTLSVersionstring
- minTlsVersionstring
- maxTLSVersionstring
- maxTlsVersionstring
- keyExchangeGroupsstring[]
- providers
- *namestring
- params
- modelstring
- apiKey
- *filestring
- awsRegionstring
- vertexRegionstring
- vertexProjectstring
- azureResourceNamestring
- azureResourceTypestring
- azureApiVersionstring
- azureProjectNamestring
- baseUrlstring
- hostOverridestring
- pathOverridestring
- pathPrefixstring
- tokenizeboolean
- *provider
- *referencestring
- defaults
- defaultsobject
- overridesobject
- transformationobject
- requestHeaders
- addobject
- setobject
- removestring[]
- responseHeaders
- addobject
- setobject
- removestring[]
- backendTLS
- certstring
- keystring
- rootstring
- hostnamestring
- insecureboolean
- insecureHostboolean
- alpnstring[]
- subjectAltNamesstring[]
- keyExchangeGroupsstring[]
- tls
- certstring
- keystring
- rootstring
- hostnamestring
- insecureboolean
- insecureHostboolean
- alpnstring[]
- subjectAltNamesstring[]
- keyExchangeGroupsstring[]
- auth
- *passthrough
- location
- *header
- *namestring
- prefixstring
- health
- unhealthyExpressionstring
- eviction
- durationstring
- restoreHealthnumber
- consecutiveFailuresinteger
- healthThresholdnumber
- backendTunnel
- *proxy
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- promptCaching
- cacheSystemboolean
- cacheMessagesboolean
- cacheToolsboolean
- minTokensinteger
- cacheMessageOffsetinteger
- *models
- *namestring
- visibilitystring
- params
- modelstring
- apiKey
- *filestring
- awsRegionstring
- vertexRegionstring
- vertexProjectstring
- azureResourceNamestring
- azureResourceTypestring
- azureApiVersionstring
- azureProjectNamestring
- baseUrlstring
- hostOverridestring
- pathOverridestring
- pathPrefixstring
- tokenizeboolean
- *provider
- *referencestring
- passthroughstring
- authorization
- *rules
- *allowstring
- defaultsobject
- overridesobject
- transformationobject
- requestHeaders
- addobject
- setobject
- removestring[]
- responseHeaders
- addobject
- setobject
- removestring[]
- backendTLS
- certstring
- keystring
- rootstring
- hostnamestring
- insecureboolean
- insecureHostboolean
- alpnstring[]
- subjectAltNamesstring[]
- keyExchangeGroupsstring[]
- tls
- certstring
- keystring
- rootstring
- hostnamestring
- insecureboolean
- insecureHostboolean
- alpnstring[]
- subjectAltNamesstring[]
- keyExchangeGroupsstring[]
- auth
- *passthrough
- location
- *header
- *namestring
- prefixstring
- health
- unhealthyExpressionstring
- eviction
- durationstring
- restoreHealthnumber
- consecutiveFailuresinteger
- healthThresholdnumber
- backendTunnel
- *proxy
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- guardrails
- streamingstring
- request
- *regex
- actionstring
- *rules
- *builtinstring
- response
- *regex
- actionstring
- *rules
- *builtinstring
- promptCaching
- cacheSystemboolean
- cacheMessagesboolean
- cacheToolsboolean
- minTokensinteger
- cacheMessageOffsetinteger
- matches
- headers
- *namestring
- *value
- *exactstring
- virtualModels
- *namestring
- *routing
- weighted
- *targets
- *modelstring
- weightinteger
- failover
- *targets
- *modelstring
- *priorityinteger
- conditional
- *targets
- whenstring
- *modelstring
- policies
- oidc
- *issuerstring
- discovery
- *filestring
- authorizationEndpointstring
- tokenEndpointstring
- tokenEndpointAuthstring
- jwks
- *filestring
- *clientIdstring
- *clientSecretstring
- *redirectURIstring
- scopesstring[]
- jwtAuth
- modestring
- location
- *header
- *namestring
- prefixstring
- *providers
- *issuerstring
- audiencesstring[]
- *jwks
- *filestring
- jwtValidationOptions
- requiredClaimsstring[]
- authorization
- *rules
- *allowstring
- extAuthz
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- extProc
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- cors
- allowCredentialsboolean
- allowHeadersstring[]
- allowMethodsstring[]
- allowOriginsstring[]
- exposeHeadersstring[]
- maxAgestring
- transformations
- *conditional
- conditionstring
- request
- addobject
- setobject
- removestring[]
- bodystring
- metadataobject
- response
- addobject
- setobject
- removestring[]
- bodystring
- metadataobject
- basicAuth
- *htpasswd
- *filestring
- realmstring
- modestring
- authorizationLocation
- *header
- *namestring
- prefixstring
- apiKey
- *keys
- *keystring
- metadata
- modestring
- location
- *header
- *namestring
- prefixstring
- guardrails
- streamingstring
- request
- *regex
- actionstring
- *rules
- *builtinstring
- response
- *regex
- actionstring
- *rules
- *builtinstring
- localRateLimit
- maxTokensinteger
- tokensPerFillinteger
- *fillIntervalstring
- typestring
- remoteRateLimit
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- mcp
- portinteger
- *targets
- *sse
- hoststring
- portinteger
- pathstring
- backendstring
- statefulModestring
- prefixModestring
- failureModestring
- policies
- requestHeaderModifier
- addobject
- setobject
- removestring[]
- responseHeaderModifier
- addobject
- setobject
- removestring[]
- requestRedirect
- schemestring
- authority
- *fullstring
- path
- *fullstring
- statusinteger
- urlRewrite
- authority
- *fullstring
- path
- *fullstring
- requestMirror
- *backend
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- *percentagenumber
- directResponse
- *conditional
- conditionstring
- bodyarray|string
- bodyExpressionstring
- headersobject
- *statusinteger
- cors
- allowCredentialsboolean
- allowHeadersstring[]
- allowMethodsstring[]
- allowOriginsstring[]
- exposeHeadersstring[]
- maxAgestring
- mcpAuthorization
- *rules
- *allowstring
- mcpGuardrails
- *processors
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- authorization
- *rules
- *allowstring
- mcpAuthentication
- *issuerstring
- *audiencesstring[]
- provider
- *auth0object
- *resourceMetadataobject
- *jwks
- *filestring
- modestring
- authorizationLocation
- *header
- *namestring
- prefixstring
- jwtValidationOptions
- requiredClaimsstring[]
- clientIdstring
- a2aobject
- ai
- promptGuard
- streamingstring
- request
- *regex
- actionstring
- *rules
- *builtinstring
- response
- *regex
- actionstring
- *rules
- *builtinstring
- defaultsobject
- overridesobject
- transformationsobject
- prompts
- append
- *rolestring
- *contentstring
- prepend
- *rolestring
- *contentstring
- modelAliasesobject
- promptCaching
- cacheSystemboolean
- cacheMessagesboolean
- cacheToolsboolean
- minTokensinteger
- cacheMessageOffsetinteger
- routesobject
- backendTLS
- certstring
- keystring
- rootstring
- hostnamestring
- insecureboolean
- insecureHostboolean
- alpnstring[]
- subjectAltNamesstring[]
- keyExchangeGroupsstring[]
- backendTunnel
- *proxy
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- backendAuth
- *passthrough
- location
- *header
- *namestring
- prefixstring
- localRateLimit
- *conditional
- conditionstring
- maxTokensinteger
- tokensPerFillinteger
- *fillIntervalstring
- typestring
- remoteRateLimit
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- jwtAuth
- modestring
- location
- *header
- *namestring
- prefixstring
- *providers
- *issuerstring
- audiencesstring[]
- *jwks
- *filestring
- jwtValidationOptions
- requiredClaimsstring[]
- oidc
- *issuerstring
- discovery
- *filestring
- authorizationEndpointstring
- tokenEndpointstring
- tokenEndpointAuthstring
- jwks
- *filestring
- *clientIdstring
- *clientSecretstring
- *redirectURIstring
- scopesstring[]
- basicAuth
- *htpasswd
- *filestring
- realmstring
- modestring
- authorizationLocation
- *header
- *namestring
- prefixstring
- apiKey
- *keys
- *keystring
- metadata
- modestring
- location
- *header
- *namestring
- prefixstring
- extAuthz
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- extProc
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- transformations
- *conditional
- conditionstring
- request
- addobject
- setobject
- removestring[]
- bodystring
- metadataobject
- response
- addobject
- setobject
- removestring[]
- bodystring
- metadataobject
- csrf
- additionalOriginsstring[]
- buffer
- request
- maxBytesinteger
- response
- maxBytesinteger
- timeout
- requestTimeoutstring
- backendRequestTimeoutstring
- retry
- attemptsinteger
- backoffstring
- *codesinteger[]
- preconditionstring
- conditionstring
- policies
- *name
- *namestring
- *namespacestring
- *target
- *gateway
- *gatewayNamestring
- *gatewayNamespacestring
- listenerNamestring
- portinteger
- phasestring
- *policy
- requestHeaderModifier
- addobject
- setobject
- removestring[]
- responseHeaderModifier
- addobject
- setobject
- removestring[]
- requestRedirect
- schemestring
- authority
- *fullstring
- path
- *fullstring
- statusinteger
- urlRewrite
- authority
- *fullstring
- path
- *fullstring
- requestMirror
- *backend
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- *percentagenumber
- directResponse
- *conditional
- conditionstring
- bodyarray|string
- bodyExpressionstring
- headersobject
- *statusinteger
- cors
- allowCredentialsboolean
- allowHeadersstring[]
- allowMethodsstring[]
- allowOriginsstring[]
- exposeHeadersstring[]
- maxAgestring
- mcpAuthorization
- *rules
- *allowstring
- mcpGuardrails
- *processors
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- authorization
- *rules
- *allowstring
- mcpAuthentication
- *issuerstring
- *audiencesstring[]
- provider
- *auth0object
- *resourceMetadataobject
- *jwks
- *filestring
- modestring
- authorizationLocation
- *header
- *namestring
- prefixstring
- jwtValidationOptions
- requiredClaimsstring[]
- clientIdstring
- a2aobject
- ai
- promptGuard
- streamingstring
- request
- *regex
- actionstring
- *rules
- *builtinstring
- response
- *regex
- actionstring
- *rules
- *builtinstring
- defaultsobject
- overridesobject
- transformationsobject
- prompts
- append
- *rolestring
- *contentstring
- prepend
- *rolestring
- *contentstring
- modelAliasesobject
- promptCaching
- cacheSystemboolean
- cacheMessagesboolean
- cacheToolsboolean
- minTokensinteger
- cacheMessageOffsetinteger
- routesobject
- backendTLS
- certstring
- keystring
- rootstring
- hostnamestring
- insecureboolean
- insecureHostboolean
- alpnstring[]
- subjectAltNamesstring[]
- keyExchangeGroupsstring[]
- backendTunnel
- *proxy
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- backendAuth
- *passthrough
- location
- *header
- *namestring
- prefixstring
- localRateLimit
- *conditional
- conditionstring
- maxTokensinteger
- tokensPerFillinteger
- *fillIntervalstring
- typestring
- remoteRateLimit
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- jwtAuth
- modestring
- location
- *header
- *namestring
- prefixstring
- *providers
- *issuerstring
- audiencesstring[]
- *jwks
- *filestring
- jwtValidationOptions
- requiredClaimsstring[]
- oidc
- *issuerstring
- discovery
- *filestring
- authorizationEndpointstring
- tokenEndpointstring
- tokenEndpointAuthstring
- jwks
- *filestring
- *clientIdstring
- *clientSecretstring
- *redirectURIstring
- scopesstring[]
- basicAuth
- *htpasswd
- *filestring
- realmstring
- modestring
- authorizationLocation
- *header
- *namestring
- prefixstring
- apiKey
- *keys
- *keystring
- metadata
- modestring
- location
- *header
- *namestring
- prefixstring
- extAuthz
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- extProc
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- transformations
- *conditional
- conditionstring
- request
- addobject
- setobject
- removestring[]
- bodystring
- metadataobject
- response
- addobject
- setobject
- removestring[]
- bodystring
- metadataobject
- csrf
- additionalOriginsstring[]
- buffer
- request
- maxBytesinteger
- response
- maxBytesinteger
- timeout
- requestTimeoutstring
- backendRequestTimeoutstring
- retry
- attemptsinteger
- backoffstring
- *codesinteger[]
- preconditionstring
- conditionstring
- workloads
- services
- backends
- *hoststring
- routeGroups
- *namestring
- *routes
- namestring
- namespacestring
- ruleNamestring
- hostnamesstring[]
- matches
- headers
- *namestring
- *value
- *exactstring
- path
- *exactstring
- methodstring
- query
- *namestring
- *value
- *exactstring
- policies
- requestHeaderModifier
- addobject
- setobject
- removestring[]
- responseHeaderModifier
- addobject
- setobject
- removestring[]
- requestRedirect
- schemestring
- authority
- *fullstring
- path
- *fullstring
- statusinteger
- urlRewrite
- authority
- *fullstring
- path
- *fullstring
- requestMirror
- *backend
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- *percentagenumber
- directResponse
- *conditional
- conditionstring
- bodyarray|string
- bodyExpressionstring
- headersobject
- *statusinteger
- cors
- allowCredentialsboolean
- allowHeadersstring[]
- allowMethodsstring[]
- allowOriginsstring[]
- exposeHeadersstring[]
- maxAgestring
- mcpAuthorization
- *rules
- *allowstring
- mcpGuardrails
- *processors
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- authorization
- *rules
- *allowstring
- mcpAuthentication
- *issuerstring
- *audiencesstring[]
- provider
- *auth0object
- *resourceMetadataobject
- *jwks
- *filestring
- modestring
- authorizationLocation
- *header
- *namestring
- prefixstring
- jwtValidationOptions
- requiredClaimsstring[]
- clientIdstring
- a2aobject
- ai
- promptGuard
- streamingstring
- request
- *regex
- actionstring
- *rules
- *builtinstring
- response
- *regex
- actionstring
- *rules
- *builtinstring
- defaultsobject
- overridesobject
- transformationsobject
- prompts
- append
- *rolestring
- *contentstring
- prepend
- *rolestring
- *contentstring
- modelAliasesobject
- promptCaching
- cacheSystemboolean
- cacheMessagesboolean
- cacheToolsboolean
- minTokensinteger
- cacheMessageOffsetinteger
- routesobject
- backendTLS
- certstring
- keystring
- rootstring
- hostnamestring
- insecureboolean
- insecureHostboolean
- alpnstring[]
- subjectAltNamesstring[]
- keyExchangeGroupsstring[]
- backendTunnel
- *proxy
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- backendAuth
- *passthrough
- location
- *header
- *namestring
- prefixstring
- localRateLimit
- *conditional
- conditionstring
- maxTokensinteger
- tokensPerFillinteger
- *fillIntervalstring
- typestring
- remoteRateLimit
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- jwtAuth
- modestring
- location
- *header
- *namestring
- prefixstring
- *providers
- *issuerstring
- audiencesstring[]
- *jwks
- *filestring
- jwtValidationOptions
- requiredClaimsstring[]
- oidc
- *issuerstring
- discovery
- *filestring
- authorizationEndpointstring
- tokenEndpointstring
- tokenEndpointAuthstring
- jwks
- *filestring
- *clientIdstring
- *clientSecretstring
- *redirectURIstring
- scopesstring[]
- basicAuth
- *htpasswd
- *filestring
- realmstring
- modestring
- authorizationLocation
- *header
- *namestring
- prefixstring
- apiKey
- *keys
- *keystring
- metadata
- modestring
- location
- *header
- *namestring
- prefixstring
- extAuthz
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- extProc
- *conditional
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
- transformations
- *conditional
- conditionstring
- request
- addobject
- setobject
- removestring[]
- bodystring
- metadataobject
- response
- addobject
- setobject
- removestring[]
- bodystring
- metadataobject
- csrf
- additionalOriginsstring[]
- buffer
- request
- maxBytesinteger
- response
- maxBytesinteger
- timeout
- requestTimeoutstring
- backendRequestTimeoutstring
- retry
- attemptsinteger
- backoffstring
- *codesinteger[]
- preconditionstring
- conditionstring
- backends
- *service
- *name
- *namespacestring
- *hostnamestring
- *portinteger
Validation
upstream connections.
Accepted values: All, Auto, V4Preferred, V4Only, V6Only.
Defaults to Auto (IPv4-only when enableIpv6 is false, both when true).
Validation
When
None, the system-provided resolver setting is preserved.Can also be set via the
DNS_EDNS0 environment variable.connections. The local trust_domain is always implicitly included.
If not set, sessions will not be encrypted.
For example, generated via
openssl rand -hex 32.Validation
Validation
Validation
Validation
Validation
Validation
Validation
Random sampling will initiate a new trace span if the incoming request does not have a trace already.
This should evaluate to either a float between 0.0-1.0 (0-100%) or true/false.
This defaults to 'false'.
Client sampling determines whether to initiate a new trace span if the incoming request does have a trace already.
This should evaluate to either a float between 0.0-1.0 (0-100%) or true/false.
This defaults to 'true'.
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
the total number of connections kept alive to any given host.
Note: excess connections will still be created, they will just not remain idle.
If unset, there is no limit
Validation
Validation
Validation
Validation
Validation
Validation
Validation
performance degradation, even when set lower than the default of 100.
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
closed after the current in-flight request completes. Useful for even traffic distribution
behind load balancers during scaling events.
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
version matching and whether PROXY headers are required or optional.
Validation
Validation
Validation
version matching and whether PROXY headers are required or optional.
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
mode uses cert/key as a CA for on-demand SNI leaf certificate issuance.
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
http or https.Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Access-Control-Allow-Credentials: true on allowed CORS responses.Validation
Access-Control-Allow-Headers for allowed preflight requests.Validation
Access-Control-Allow-Methods for allowed preflight requests.Validation
* to match any origin.Validation
Access-Control-Expose-Headers for allowed CORS responses.Validation
Access-Control-Max-Age for allowed preflight requests.Validation
Validation
Validation
to reject a request short-circuits the chain. Processors may run on the
request or response side, or both; see
Processor.methods.Validation
Validation
Validation
iss claim.aud claim.Validation
Validation
Bearer or Basic .Only "exp", "nbf", "aud", "iss", "sub" are enforced; others
(including "iat" and "jti") are ignored.
Defaults to ["exp"]. Use an empty list to require no claims.
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Bearer or Basic .Validation
Validation
Validation
Validation
Validation
Validation
Validation
Bearer or Basic .iss claim.aud claim when set.Only "exp", "nbf", "aud", "iss", "sub" are enforced; others
(including "iat" and "jti") are ignored.
Defaults to ["exp"]. Use an empty list to require no claims.
Validation
${issuer}/.well-known/openid-configuration.Validation
Validation
clientSecretBasic when omitted.Validation
This policy always redirects unauthenticated non-callback requests back through this login
flow.
openid is always included.Validation
WWW-Authenticate response header when credentials are missing or invalid.Validation
Validation
Validation
Bearer or Basic .Validation
Validation
Bearer or Basic .Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
false,retries are disabled (only the initial attempt is made), e.g.
request.method == "GET".Retrying requires buffering the request body in memory for replay, so this lets us skip
that cost when the request is known to be non-retriable (e.g. streaming or websockets).
is retried when its status code is in
codes *or* this expression evaluates to true.Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
${issuer}/.well-known/openid-configuration.Validation
Validation
clientSecretBasic when omitted.Validation
This policy always redirects unauthenticated non-callback requests back through this login
flow.
openid is always included.Validation
Validation
Validation
Bearer or Basic .iss claim.aud claim when set.Only "exp", "nbf", "aud", "iss", "sub" are enforced; others
(including "iat" and "jti") are ignored.
Defaults to ["exp"]. Use an empty list to require no claims.
Validation
Validation
Validation
Validation
Validation
Access-Control-Allow-Credentials: true on allowed CORS responses.Validation
Access-Control-Allow-Headers for allowed preflight requests.Validation
Access-Control-Allow-Methods for allowed preflight requests.Validation
* to match any origin.Validation
Access-Control-Expose-Headers for allowed CORS responses.Validation
Access-Control-Max-Age for allowed preflight requests.Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
WWW-Authenticate response header when credentials are missing or invalid.Validation
Validation
Validation
Bearer or Basic .Validation
Validation
Bearer or Basic .Validation
Validation
mode uses cert/key as a CA for on-demand SNI leaf certificate issuance.
Validation
Validation
Validation
Validation
Validation
If unset, the same model will be used from the request.
Validation
If unset this will be automatically detected from the environment.
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Bearer or Basic .Mirrors the proto
Health message structure.true marks the backend response as unhealthy.When unset, any 5xx response or connection failure is treated as unhealthy.
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
model in the users request that is matched; the model sent to the actual LLM can be overridden
on a per-model basis.
will be used in the request to the LLM provider. If not, the incoming model is used.
virtualModel).Validation
If unset, the same model will be used from the request.
Validation
If unset this will be automatically detected from the environment.
Validation
Validation
Validation
Validation
Validation
Validation
Validation
By default, requests will be parsed and translated as needed.
With passthrough, they will be unmodified and optionally inspected (with
detect).In this mode, requests must be sent in the native format of the provider.
Validation
To override even when set, use
overrides.Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Bearer or Basic .true marks the backend response as unhealthy.When unset, any 5xx response or connection failure is treated as unhealthy.
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
model in the users request that is matched. However, unlike the
models field, virtual models willdynamically route to a specific model (configured in
models) based on the configured logic.Validation
Within a priority level, the best provider is selected by a composite score factoring in health
and latency.
If all models within a priority level are degraded, requests will move onto the next priority group.
Validation
in order until the best match is found.
Validation
${issuer}/.well-known/openid-configuration.Validation
Validation
clientSecretBasic when omitted.Validation
This policy always redirects unauthenticated non-callback requests back through this login
flow.
openid is always included.Validation
Validation
Validation
Bearer or Basic .iss claim.aud claim when set.Only "exp", "nbf", "aud", "iss", "sub" are enforced; others
(including "iat" and "jti") are ignored.
Defaults to ["exp"]. Use an empty list to require no claims.
Validation
Validation
Validation
Validation
Validation
Access-Control-Allow-Credentials: true on allowed CORS responses.Validation
Access-Control-Allow-Headers for allowed preflight requests.Validation
Access-Control-Allow-Methods for allowed preflight requests.Validation
* to match any origin.Validation
Access-Control-Expose-Headers for allowed CORS responses.Validation
Access-Control-Max-Age for allowed preflight requests.Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
WWW-Authenticate response header when credentials are missing or invalid.Validation
Validation
Validation
Bearer or Basic .Validation
Validation
Bearer or Basic .Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Defaults to
failClosed.Validation
Validation
Validation
Validation
http or https.Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Access-Control-Allow-Credentials: true on allowed CORS responses.Validation
Access-Control-Allow-Headers for allowed preflight requests.Validation
Access-Control-Allow-Methods for allowed preflight requests.Validation
* to match any origin.Validation
Access-Control-Expose-Headers for allowed CORS responses.Validation
Access-Control-Max-Age for allowed preflight requests.Validation
Validation
Validation
to reject a request short-circuits the chain. Processors may run on the
request or response side, or both; see
Processor.methods.Validation
Validation
Validation
iss claim.aud claim.Validation
Validation
Bearer or Basic .Only "exp", "nbf", "aud", "iss", "sub" are enforced; others
(including "iat" and "jti") are ignored.
Defaults to ["exp"]. Use an empty list to require no claims.
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Bearer or Basic .Validation
Validation
Validation
Validation
Validation
Validation
Validation
Bearer or Basic .iss claim.aud claim when set.Only "exp", "nbf", "aud", "iss", "sub" are enforced; others
(including "iat" and "jti") are ignored.
Defaults to ["exp"]. Use an empty list to require no claims.
Validation
${issuer}/.well-known/openid-configuration.Validation
Validation
clientSecretBasic when omitted.Validation
This policy always redirects unauthenticated non-callback requests back through this login
flow.
openid is always included.Validation
WWW-Authenticate response header when credentials are missing or invalid.Validation
Validation
Validation
Bearer or Basic .Validation
Validation
Bearer or Basic .Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
false,retries are disabled (only the initial attempt is made), e.g.
request.method == "GET".Retrying requires buffering the request body in memory for replay, so this lets us skip
that cost when the request is known to be non-retriable (e.g. streaming or websockets).
is retried when its status code is in
codes *or* this expression evaluates to true.This is an advanced feature; users should typically use the inline
policies field under route/gateway.Validation
Use route policies by default unless the policy needs to affect route selection.
Validation
Validation
Validation
Validation
http or https.Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Access-Control-Allow-Credentials: true on allowed CORS responses.Validation
Access-Control-Allow-Headers for allowed preflight requests.Validation
Access-Control-Allow-Methods for allowed preflight requests.Validation
* to match any origin.Validation
Access-Control-Expose-Headers for allowed CORS responses.Validation
Access-Control-Max-Age for allowed preflight requests.Validation
Validation
Validation
to reject a request short-circuits the chain. Processors may run on the
request or response side, or both; see
Processor.methods.Validation
Validation
Validation
iss claim.aud claim.Validation
Validation
Bearer or Basic .Only "exp", "nbf", "aud", "iss", "sub" are enforced; others
(including "iat" and "jti") are ignored.
Defaults to ["exp"]. Use an empty list to require no claims.
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Bearer or Basic .Validation
Validation
Validation
Validation
Validation
Validation
Validation
Bearer or Basic .iss claim.aud claim when set.Only "exp", "nbf", "aud", "iss", "sub" are enforced; others
(including "iat" and "jti") are ignored.
Defaults to ["exp"]. Use an empty list to require no claims.
Validation
${issuer}/.well-known/openid-configuration.Validation
Validation
clientSecretBasic when omitted.Validation
This policy always redirects unauthenticated non-callback requests back through this login
flow.
openid is always included.Validation
WWW-Authenticate response header when credentials are missing or invalid.Validation
Validation
Validation
Bearer or Basic .Validation
Validation
Bearer or Basic .Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
false,retries are disabled (only the initial attempt is made), e.g.
request.method == "GET".Retrying requires buffering the request body in memory for replay, so this lets us skip
that cost when the request is known to be non-retriable (e.g. streaming or websockets).
is retried when its status code is in
codes *or* this expression evaluates to true.Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
http or https.Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Access-Control-Allow-Credentials: true on allowed CORS responses.Validation
Access-Control-Allow-Headers for allowed preflight requests.Validation
Access-Control-Allow-Methods for allowed preflight requests.Validation
* to match any origin.Validation
Access-Control-Expose-Headers for allowed CORS responses.Validation
Access-Control-Max-Age for allowed preflight requests.Validation
Validation
Validation
to reject a request short-circuits the chain. Processors may run on the
request or response side, or both; see
Processor.methods.Validation
Validation
Validation
iss claim.aud claim.Validation
Validation
Bearer or Basic .Only "exp", "nbf", "aud", "iss", "sub" are enforced; others
(including "iat" and "jti") are ignored.
Defaults to ["exp"]. Use an empty list to require no claims.
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Bearer or Basic .Validation
Validation
Validation
Validation
Validation
Validation
Validation
Bearer or Basic .iss claim.aud claim when set.Only "exp", "nbf", "aud", "iss", "sub" are enforced; others
(including "iat" and "jti") are ignored.
Defaults to ["exp"]. Use an empty list to require no claims.
Validation
${issuer}/.well-known/openid-configuration.Validation
Validation
clientSecretBasic when omitted.Validation
This policy always redirects unauthenticated non-callback requests back through this login
flow.
openid is always included.Validation
WWW-Authenticate response header when credentials are missing or invalid.Validation
Validation
Validation
Bearer or Basic .Validation
Validation
Bearer or Basic .Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
Validation
false,retries are disabled (only the initial attempt is made), e.g.
request.method == "GET".Retrying requires buffering the request body in memory for replay, so this lets us skip
that cost when the request is known to be non-retriable (e.g. streaming or websockets).
is retried when its status code is in
codes *or* this expression evaluates to true.