Policy creation API

Create a policy (V2)

POST /api/v2/policies
Content-Type: application/json

Create a policy attachment (V1)

POST /api/v1/policy-attachments
Content-Type: application/json

Basic request structures

{
  "name": "Policy name",
  "className": "Policy type",
  "config": "Policy configuration JSON string",
  "description": "Policy description (optional)"
}

{
  "attachResourceId": "ResourceID1",
  "attachResourceType": "Resource type",
  "environmentId": "Environment ID",
  "gatewayId": "Gateway ID",
  "policyId": "Policy ID"
}

General throttling policies

• RateLimit - Rate limiting

• ConcurrencyLimit - Concurrency limiting

• CircuitBreaker - Circuit breaking

• Timeout - Timeout control

• Retry - Retry policy

Routing and forwarding policies

• HttpRewrite - HTTP rewrite

• HeaderModify - Header modification

• Redirect - Redirection

• DirectResponse - Direct response

• Fallback - Fallback policy

• DynamicRoute - Dynamic routing (swimlane)

AI-related policies

• AiStatistics - AI statistics

• AiSecurityGuard - AI Guardrails

• AiFallback - AI fallback

• AiTokenRateLimit - AI token rate limiting

• AiCache - AI cache

• AiNetworkSearch - AI network search

• AiToolSelection - AI tool selection

Security and authentication policies

• Authentication - Unified authentication

• JWTAuth - JWT authentication

• OIDCAuth - OIDC authentication

• ExternalZAuth - External authentication

• Waf - Web Application Firewall

• IpAccessControl - IP access control

Cross-domain and replication policies

• Cors - Cross-origin resource sharing

• FlowCopy - Traffic replication

Service administration policies

• ServiceTls - Service TLS

• ServiceLb - Service load balancing

• ServicePortTls - Service port TLS

RateLimit - Rate limiting

Scope: Route, Gateway, Domain, Service

Configuration:

{
  "threshold": 100,
  "behaviorType": 0,
  "bodyEncoding": 0,
  "responseStatusCode": 429,
  "responseContentBody": "{\"error\":\"Too Many Requests\"}",
  "responseRedirectUrl": "",
  "enable": true
}

Example call:

curl -X POST http://gateway-api/api/v2/policies \
  -H "Content-Type: application/json" \
  -d '{
    "name": "API Rate Limit Policy",
    "className": "RateLimit",
    "config": "{\"threshold\":100,\"behaviorType\":0,\"bodyEncoding\":1,\"responseStatusCode\":429,\"responseContentBody\":\"{\\\"error\\\":\\\"Too Many Requests\\\"}\",\"enable\":true}",
    "description": "Limits API requests to 100 per second."
  }'

ConcurrencyLimit - Concurrency limiting

Scope: Route, Gateway, Domain

Configuration:

{
  "maxConcurrency": 50,
  "behaviorType": 0,
  "bodyEncoding": 0,
  "responseStatusCode": 503,
  "responseContentBody": "{\"error\":\"Service Overloaded\"}",
  "responseRedirectUrl": "",
  "enable": true
}

CircuitBreaker - Circuit breaking

Scope: Route, Service

Configuration:

{
  "strategy": 0,
  "minRequestAmount": 10,
  "maxAllowedMs": 5000,
  "triggerRatio": 50,
  "statDurationSec": 30,
  "recoveryTimeoutSec": 30,
  "responseStatusCode": 503,
  "bodyEncoding": 0,
  "responseContentBody": "{\"error\":\"Service Unavailable\"}",
  "responseRedirectUrl": "",
  "behaviorType": 0,
  "enable": true
}

Timeout - Timeout control

Scope: Route, Service

Configuration:

{
  "unitNum": 30,
  "timeUnit": "s",
  "enable": true
}

Retry - Retry policy

Scope: Route, Service

Configuration:

{
  "attempts": 3,
  "retryOn": ["5xx", "reset", "connect-failure"],
  "httpCodes": ["502", "503", "504"],
  "perTryTimeout": 10,
  "enable": true
}

HttpRewrite - HTTP rewrite

Scope: Route

Configuration:

{
  "pathType": "Exact",
  "path": "/v2/api",
  "pattern": "",
  "substitution": "",
  "host": "new-backend.example.com",
  "enable": true
}

HeaderModify - Header modification

Scope: Route, Gateway, Domain

Configuration:

{
  "enable": true,
  "headerOpItems": [
    {
      "directionType": "Request",
      "opType": "Add",
      "key": "X-Custom-Header",
      "value": "custom-value",
      "policyValueGenerateMode": "Custom"
    },
    {
      "directionType": "Request",
      "opType": "Update",
      "key": "Authorization",
      "value": "Bearer {{token}}",
      "policyValueGenerateMode": "Custom"
    },
    {
      "directionType": "Request",
      "opType": "Remove",
      "key": "X-Debug-Mode",
      "value": "",
      "policyValueGenerateMode": "Custom"
    }
  ]
}

Redirect - Redirection

Scope: Route

Configuration:

{
  "code": "301",
  "host": "new-domain.com",
  "path": "/new-path",
  "enable": true
}

DirectResponse - Direct response

Scope: Route

Configuration:

{
  "code": "200",
  "body": "{\"status\":\"ok\",\"message\":\"Service Maintenance\"}",
  "enable": true
}

Fallback - Fallback policy

Scope: Route, Service

Configuration:

{
  "enable": true,
  "fallBackDestination": [
    {
      "serviceId": "backup-service-1",
      "serviceName": "backup-service-name",
      "serviceVersion": "v1",
      "port": "8080"
    }
  ]
}

IpAccessControl - IP access control

Scope: Route, Gateway, Domain

Configuration:

{
  "name": "IP Whitelist Policy",
  "description": "Allow access from specific IPs",
  "ipAccessControlResourceName": "api-route-1",
  "ipAccessControlResourceType": "Route",
  "ipAccessControlType": "White",
  "ipAccessControlContent": "192.168.1.0/24,10.0.0.1",
  "protocolLayer": "L7",
  "enable": true
}

Cors - Cross-origin resource sharing

Scope: Route, Gateway, Domain

Configuration:

{
  "allowOrigins": "https://example.com,https://app.example.com",
  "allowMethods": ["GET", "POST", "PUT", "DELETE"],
  "allowHeaders": "Content-Type,Authorization",
  "exposeHeaders": "X-Custom-Header",
  "timeUnit": "s",
  "unitNum": 3600,
  "allowCredentials": true,
  "enable": true
}

FlowCopy - Traffic replication

Scope: Route

Configuration:

{
  "targetServiceId": "test-service-id",
  "targetServiceName": "test-service",
  "port": "8080",
  "percentage": 10,
  "enable": true
}

DynamicRoute - Dynamic routing (swimlane)

Scope: Gateway

Configuration:

{
  "enable": true,
  "dynamicRouteSwimmingLaneConfigs": [
    {
      "swimmingLaneGroupId": 1001,
      "swimmingLaneId": 2001,
      "canaryModel": 0,
      "percentage": 20,
      "swimmingLaneTag": "lane-v2",
      "predicates": [
        {
          "type": "Header",
          "name": "x-env",
          "condition": "==",
          "value": "test"
        }
      ],
      "matchCondition": "And",
      "enable": true
    }
  ]
}

AiStatistics - AI statistics

Scope: Route, LLMApi, AgentApi

Configuration:

{
  "enable": true,
  "aiStatisticsConfig": {
    "logRequestContent": true,
    "logResponseContent": true
  }
}

AiSecurityGuard - AI Guardrails

Scope: Service

Configuration:

{
  "enable": true,
  "serviceAddress": "http://security-guard-service:8080",
  "checkRequest": true,
  "checkResponse": true,
  "riskAlertLevel": "medium",
  "requestCheckService": "Security",
  "responseCheckService": "Security",
  "bufferLimit": 1000,
  "riskConfig": [
    {
      "type": "Global",
      "level": "high"
    },
    {
      "type": "ContentModeration",
      "level": "medium"
    }
  ]
}

AiTokenRateLimit - AI token rate limiting

Scope: Route, LLMApi, AgentApi

Configuration:

{
  "enable": true,
  "rules": [
    {
      "limitType": "LimitByConsumer",
      "threshold": 10000,
      "timeWindow": 60,
      "responseStatusCode": 429,
      "responseContentBody": "{\"error\":\"Token limit exceeded\"}"
    }
  ],
  "enableGlobalRules": true,
  "globalRules": [
    {
      "limitType": "LimitByGlobal",
      "threshold": 100000,
      "timeWindow": 60
    }
  ],
  "redisConfig": {
    "serviceHost": "redis-service:6379",
    "servicePort": 6379,
    "database": 0,
    "username": "",
    "password": ""
  }
}

AiCache - AI cache

Scope: Route, LLMApi, AgentApi

Configuration:

{
  "enable": true,
  "cacheTTL": 3600,
  "cacheMode": "exact",
  "cacheKeyStrategy": "messages",
  "redisConfig": {
    "serviceHost": "redis-service:6379",
    "servicePort": 6379,
    "database": 0
  }
}

AiFallback - AI fallback

Scope: Service

Configuration:

{
  "enable": true,
  "fallbackModelMappings": [
    {
      "model": "gpt-4",
      "fallbackModels": [
        {
          "serviceId": "backup-service-1",
          "model": "gpt-3.5-turbo"
        }
      ]
    }
  ]
}

AiNetworkSearch - AI network search

Scope: Route, LLMApi, AgentApi

Configuration:

{
  "enable": true,
  "provider": "bing",
  "apiKey": "your-search-api-key",
  "maxResults": 10,
  "timeout": 5000
}

AiToolSelection - AI tool selection

Scope: Route, LLMApi, AgentApi

Configuration:

{
  "enable": true,
  "tools": [
    {
      "name": "calculator",
      "description": "Used for mathematical calculations",
      "enabled": true
    }
  ]
}

Authentication - Unified authentication

Scope: Route, Gateway, Domain

Configuration:

{
  "authenticationType": "key-auth",
  "enable": true
}

JWTAuth - JWT authentication

Scope: Route, Gateway, Domain

Configuration:

{
  "name": "jwt-policy",
  "issuer": "https://auth.example.com",
  "sub": "",
  "jwks": "https://auth.example.com/.well-known/jwks.json",
  "tokenPosition": "header",
  "tokenName": "Authorization",
  "tokenNamePrefix": "Bearer ",
  "tokenPass": true,
  "whiteOrBlack": "",
  "authResources": [],
  "resources": "",
  "enable": true
}

OIDCAuth - OIDC authentication

Scope: Route, Gateway, Domain

Configuration:

{
  "issuer": "https://accounts.google.com",
  "clientId": "your-client-id",
  "clientSecret": "your-client-secret",
  "redirectUri": "https://your-app.com/callback",
  "scopes": ["openid", "profile", "email"],
  "enable": true
}

ExternalZAuth - External authentication

Scope: Route, Gateway, Domain

Configuration:

{
  "authServiceUrl": "https://auth-service.example.com/verify",
  "timeout": 5000,
  "enable": true
}

Waf - Web Application Firewall

Scope: Route, Gateway, Domain

Configuration:

{
  "enable": true
}

ServiceLb - Service load balancing

Scope: Service

Configuration:

{
  "loadBalancerType": "ROUND_ROBIN",
  "consistentHashLBConfig": {
    "parameterName": "user-id",
    "httpCookie": {
      "name": "session-id",
      "path": "/",
      "ttl": "3600s"
    },
    "minimumRingSize": 1024,
    "consistentHashLBType": "HEADER"
  },
  "warmupDuration": 60,
  "enable": true
}

ServiceTls - Service TLS

Scope: Service

Configuration:

{
  "mode": "SIMPLE",
  "certId": "cert-id-123",
  "caCertId": "ca-cert-id-456",
  "caCertContent": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
  "subjectAltNames": ["*.example.com"],
  "sni": "backend-service.example.com",
  "enable": true
}

ServicePortTls - Service port TLS

Scope: ServicePort

Configuration: Same as ServiceTls.

Error example 1: Incorrect format for the config field

{
  "name": "Rate Limit Policy",
  "className": "RateLimit",
  "config": {"threshold": 100}  // Error: config must be a JSON string
}

Correct format:

{
  "name": "Rate Limit Policy",
  "className": "RateLimit",
  "config": "{\"threshold\":100,\"behaviorType\":0,\"bodyEncoding\":0,\"responseStatusCode\":429,\"enable\":true}"
}

Error example 2: Missing enable field

{
  "name": "Rate Limit Policy",
  "className": "RateLimit",
  "config": "{\"threshold\":100,\"behaviorType\":0,\"bodyEncoding\":0,\"responseStatusCode\":429}"  // The enable field is missing
}

Correct format:

{
  "name": "Rate Limit Policy",
  "className": "RateLimit",
  "config": "{\"threshold\":100,\"behaviorType\":0,\"bodyEncoding\":0,\"responseStatusCode\":429,\"enable\":true}"
}

Successful response

{
  "policyId": "policy-abc123"
}

Error response

{
  "errorCode": "ErrInvalidParameter",
  "errorMessage": "Invalid parameter: className",
  "requestId": "req-xxx"
}